The Employee Left the Company. Did Their Access Leave Too?

The employee has finished their job. The laptop was returned. The badge was deactivated. The exit interview took place. As far as HR is concerned, the process is complete.

But in the digital world an important question remains: did all of their access to the organization end too?

One employee can have dozens of accounts

Once, a user received a Windows account and an email address. Today the environment is different: Microsoft 365, CRM, a finance system, a task management tool, VPN, SaaS systems, marketing tools, vendor portals, a support system, access to servers or the cloud, and apps bought directly by a specific department.

Some of these systems are connected to a central identity system. Some are not. That means closing the main account does not necessarily end every piece of access the employee received over the years.

The problem does not start on the day they leave

An employee started in one role and received permissions accordingly. A year later they were promoted and received more permissions. Then they moved to another department and received even more. They joined a temporary project, and more access was added.

Very few organizational processes are built around removing permissions at every change. So over time permissions can pile up. Not because anyone acted maliciously, but because the organization changed.

Why does it matter?

A basic principle of information security is that a user should get the access their job requires. Not less, but not more either.

• When a user holds unnecessary access, exposure grows.
• If their account is compromised, the attacker gets the same permissions.
• If an employee makes a mistake, more data is within reach.
• And if the organization cannot map who can reach what, it is very hard to assess the risk.

There are also accounts that are not employees

An account opened for a vendor. A temporary user for a project. A service account. An old administrator account. A shared mailbox. A system account.

Sometimes these accounts are actually riskier to manage, because no single person feels they "own" them. They can stay active for years.

A fast departure can create a point of failure

Some employees leave in a planned way, and in other cases it happens quickly. In that situation the organization needs to know which systems are relevant and who is responsible for revoking access. If you have to start looking for that information at the moment someone leaves, the process is already in a weak position.

HR and IT need to work together

HR knows when an employee starts, changes roles or leaves. IT knows which systems exist. Managers know what the employee needs to do their job. When these three worlds are not connected, blind spots appear.

That is why Joiner / Mover / Leaver is not just an administrative process. It is an information security control, and in many organizations it is also part of what an external CISO keeps track of.

What about managers and senior employees?

The more access a user has, the more important permission management becomes. Management accounts can hold broad information. IT staff can hold admin permissions. Finance can carry out sensitive actions. So not every user represents the same risk. In a Microsoft 365 environment this stands out in particular.

The simple question that is hard to answer

Try asking:

• Who in the organization can reach our financial data right now?
• Who can connect remotely to the network?
• How many people have administrator permissions?

If the answer takes several days of searching, that is already an indication there is room for improvement. A cyber risk assessment is an orderly way to get to these answers.

Access management with Marom Cyber

Marom Cyber helps organizations review identity and access management as part of the overall risk picture. It is part of our information security and cyber advisory services.

The goal is not to block employees. The goal is to make sure access stays aligned with the role and the need.