LeadingIT sets out how to revoke former employee access

What happened

LeadingIT published online guidance on 7 April 2026 urging organisations to revoke former employees’ access promptly and check for connections that can survive a password change or account shutdown.

The Chicago-area IT services provider’s article, written by Stephen Taylor, sets out a departure process covering accounts, remote connections, shared documents, devices and records. It is practical guidance rather than an announcement of a new breach, arrest or court case.

The central distinction is between disabling someone’s main login and removing every route to company information. Open sessions, permissions granted to connected applications and files already stored on personal devices can require separate action, according to the LeadingIT article, the source of this report.

The company also separates access removal from preserving business material. An organisation may need to retain a former employee’s correspondence or work files without leaving that person able to use its systems.

The background

Removing a worker’s digital permissions is commonly called deprovisioning. It forms part of offboarding, the wider departure process that includes returning equipment, handing over responsibilities and deciding what records to retain.

LeadingIT cites a OneLogin survey of 500 US IT decision-makers in which 48% of organisations reportedly knew former employees could still reach corporate applications. It says 32% took more than seven days to remove a departing employee’s access fully.

More than 100 respondents linked failures to terminate former employees’ system access to data breaches at their organisations, according to LeadingIT’s account of the survey. The article does not give the survey’s fieldwork dates, so these figures should not be read as a fresh measurement of conditions in April 2026.

The risks extend beyond deliberate misuse by someone who has left. An account that remains enabled can also be compromised by an outside attacker, making incomplete access removal relevant to both insider-risk programmes and protection against external intrusion.

As an example of deliberate damage, LeadingIT refers to an FBI account of a former Lucchese Boot Company IT administrator who used access that remained available after dismissal to shut down servers and delete files. The guide does not present this as a newly reported incident.

The organisational issue is not solely technical. Earlier CISA guidance on building insider threat management teams recommends bringing together security, human resources, legal and operational expertise, with safeguards for sensitive employee information.

What people are saying

LeadingIT says human resources should alert IT as soon as a departure is confirmed, ideally before the employee’s final conversation with their manager. Its checklist places disabling the primary account, changing relevant passwords and ending remote access within the first hour.

The company recommends centralised identity management, which lets an organisation administer access through a common service. Single sign-on allows staff to use that identity across connected applications, reducing the number of separate accounts IT must handle when someone leaves.

For applications outside that arrangement, the guide calls for individual checks and password changes. It includes shared accounts and service accounts, which software or automated processes may use, where the departing employee knew the credentials.

LeadingIT also says IT teams should force existing sessions to end across email, collaboration services and other applications. An account being disabled does not necessarily mean an already authenticated session has stopped working.

Another separate task is revoking OAuth permissions. These permissions allow one application to access another service using a digital token rather than repeatedly entering a password; the guide warns that integrations, mobile applications and browser extensions may retain that access after a password reset.

For shared documents, the publisher recommends reviewing folder membership and transferring file ownership to a manager or team account before removing the employee entirely. It says failing to distinguish ownership from access can leave colleagues unable to reach work they still need.

The guide advises examining download and sharing records from the days or weeks before departure. LeadingIT says bulk downloads or unusual sharing should be escalated for investigation, rather than treating the account shutdown as the end of the security review.

On personal phones and laptops, the company recommends mobile device management software capable of selectively removing managed company data and applications. It distinguishes this from erasing the whole device, including the employee’s personal material.

Where technical controls are unavailable, LeadingIT recommends obtaining written confirmation that company data has been removed. However, it says such an acknowledgement is a legal safeguard rather than a technical means of deleting information.

The publisher also calls for access reviews every quarter, or at least at each employee transition. It recommends assigning document permissions through centrally managed groups rather than accumulating individual sharing arrangements that become difficult to track.

What happens next

The guide proposes further tasks during the first day: removing the employee from messaging groups and distribution lists, updating telephone routing and retrieving company hardware. These steps cover operational connections beyond the main directory account.

During the first week, its checklist turns to reassigning software licences and recording what was revoked, when and by whom. The documentation provides a record for audits or a later investigation; recovering unused licences addresses the separate cost of accounts left allocated to departed staff.

For business continuity, LeadingIT suggests forwarding email to a manager or team lead for a defined period, typically 30 to 90 days, before archiving the mailbox. That is presented as an operational approach, not a universal legal retention requirement.

Records need different treatment according to their purpose. The article cites US Department of Labor guidance requiring payroll records to be retained for at least three years, and recommends involving legal advisers in industry-specific recordkeeping decisions rather than leaving IT to decide each case alone.

The company also describes automation linked to human resources systems. A change in employment status can trigger access removal through connected identity services, reducing reliance on staff manually visiting each application; its separate checks for sessions, integrations and devices remain relevant to the overall process.

If a departure review uncovers suspected theft, the task changes from routine administration to incident response. Earlier guidance on responding to former employee data theft describes securing systems, preserving evidence and considering legal remedies after suspected loss of confidential information.

LeadingIT’s publication sets no external deadline or forthcoming enforcement action. Its timetable is a recommended internal workflow for employers, rather than a regulatory schedule.