--- title: "Offboarding an employee: how many accounts stay open" url: "https://sovereos.com/blog/offboarding-an-employee-how-many-accounts-stay-open" description: "Disabling the directory account is the visible half of a leaver. The SaaS logins, shared passwords, API keys and supplier portals are the other half, and nobody owns them." --- # Offboarding an employee: how many accounts stay open October 20, 2026·4 min read·Editorial team A young woman in a dark green jumper signs a sheet of paper at a light oak desk, a laptop and a USB stick in front of her, while a colleague standing beside her holds a cardboard box with a plant and her desk things, plants and daylight behind them. A project manager hands in her laptop on a Friday afternoon. HR has the form, IT disables her account in the directory before she reaches the car park, and the mailbox is set to forward to her manager. Everyone involved does the job properly, and on Monday the company considers her gone. Three weeks later a supplier emails her about an order on their extranet, and the email is answered from her phone. In the design tool the team still pays for, she is listed as the owner of the workspace. A small script she wrote to pull delivery data into a spreadsheet runs every night on an API key issued in her name. The group chat with two customers is still on her personal number, because that is where it started. Nobody did anything wrong. The company disabled the one account it could see and had no list of the rest. ## Why identity is only partly central The directory handles sign-in for the systems that were connected to it, and in most mid-sized companies that is a minority of the systems a person actually uses. The rest were bought by a team with a company card, set up by the first user with their own email address, or came with a supplier relationship. Each of those has its own idea of who you are, and the directory has never heard of it. Disabling the central account closes the front door of a building with a dozen side entrances. ## Where leavers keep their keys **SaaS bought outside IT.** The marketing analytics tool, the project board, the e-signature service. Each has a user list, and the person who set it up is usually still its administrator, often with a login that does not go through single sign-on because the cheaper tier does not support it. **Shared passwords that were never rotated.** The social media accounts, the courier portal, the router at the branch office. If a password was shared with the leaver, it is still known to the leaver. A directory cannot revoke a word someone remembers. **API keys and automations created by a person.** Integrations are made by individuals and tied to their identity in the service that issued the key. The key keeps working after the person leaves, and when it finally stops, it stops something in production that nobody knew depended on it. **Supplier and customer portals.** The printer vendor’s portal, the leasing company’s extranet, the customer’s ticketing system. These accounts are created by the other side, in the leaver’s name, and the other side has no idea the person has left. **Devices that were not the laptop.** The phone with the authenticator app, the badge, the hardware token, the home router the VPN profile was installed on. Each is a credential, and the form only asked for the laptop. **Group chats and personal numbers.** The customer relationship that lived in a messaging app on a private phone leaves with the phone. There is no account to disable, only a conversation to be had before the last day rather than after it. ## What a real leaver process covers **A list that exists before anyone leaves.** One record per person: every system, portal, key and shared credential they hold, maintained as they are granted, not reconstructed on the last day. Most of the work of offboarding is done months earlier, at onboarding. **One identity, as many systems as possible behind it.** Each service that can authenticate against your directory should. Where a product reserves single sign-on for its most expensive tier, that is a line item in the exit cost of that product, and worth stating as one. **Ownership transfer, not deletion.** Workspaces, documents, automations and shared drives owned by the leaver move to a named successor before the account closes. Deleting first and discovering the dependencies later is how a nightly report disappears. **Rotation of everything shared.** Any secret the leaver knew is changed on the day. If the list of shared secrets is long enough that this is painful, that is a finding about the list, not about the process. **A letter to the outside.** Suppliers and customers who issued the leaver an account are told, in writing, on the day. This is the one step no system can automate, because the accounts are on someone else’s system. ## What an owned identity layer changes When the directory you control is the source of truth and the services around it trust it rather than keep their own user lists, a leaver becomes one action: disable the person, and every connected system follows. Device management wipes the laptop and the phone against the same record. The leaver process we describe for [an identity layer you own](https://sovereos.com/blog/identity-is-the-real-lock-in) is built for exactly this day. It does not close the supplier extranet, rotate the courier password or end the group chat on a private phone. Those stay manual, and a process that admits that is more trustworthy than one that claims a single button. The honest version is: one action for everything connected, and a short written list for everything that is not. The aim of owning your IT is to make the second list short, which is also the aim of [knowing what you pay for](https://sovereos.com/blog/licences-nobody-counts-the-vendor-audit-will-come). ## A test for this week Pick one person who left in the last year. Not a difficult departure, an ordinary one. Then go looking: open the admin panel of every SaaS product the company pays for and search for their name. Ask the branch office whether the router password has changed since. Ask their former manager which suppliers they dealt with, and check with one supplier whether the account is still active. Count what you find. The number tells you how many side entrances your building has, and whether the form HR uses is a leaver process or a laptop return. If the count is zero, write down how you knew where to look, because that is the beginning of the list the process needs. Most companies cannot get to zero, and that is the starting point of [IT you own](https://sovereos.com/), not a reason to be embarrassed. - offboarding - identity - access management - SaaS - IT management ## Keep reading - [How to build an agent factory for company IT, stage by stage](https://sovereos.com/blog/how-to-build-an-agent-factory-for-company-it) - [Your agent factory runs at a vendor. Who owns what it learns?](https://sovereos.com/blog/who-owns-your-agent-factory)