Disabling a user's primary account is essential, but it may not remove every path the person previously used. Modern environments include cloud sessions, API tokens, password vaults, SSH keys, local accounts, SaaS applications, and shared credentials.
Disable the primary identity
Disable or remove the employee's central identity according to organizational policy. This should block normal interactive sign-in and downstream access tied directly to the identity.
Revoke sessions and tokens
Review whether active sessions, refresh tokens, application passwords, personal access tokens, and registered API credentials require separate revocation.
Remove password-vault access
Remove the user from shared vaults and privileged collections. Review high-value credentials the person could retrieve and rotate them if policy or risk requires it.
Review SSH keys and local accounts
Servers, appliances, lab systems, network devices, and legacy applications may contain local accounts or individual SSH public keys that are not controlled by the central identity platform.
Recover managed devices
Collect corporate laptops, phones, security keys, badges, and other managed assets. Follow the organization's process for remote lock, wipe, or disablement when equipment cannot be immediately returned.
Identify owned service accounts
If the departing employee managed scripts, integrations, or service accounts, transfer ownership before the departure date. Avoid leaving automation dependent on a personal account.
Rotate unavoidable shared credentials
Shared administrator or device passwords known by the departing user may need rotation. This is one reason named accounts and password vaults are operationally easier to manage.
Document completion
Maintain an offboarding checklist that records each system reviewed and the person responsible. Do not place replacement credentials in the offboarding record.