Three moments that matter
Account problems rarely come from the quiet months in the middle. They come from the changes: someone arrives, someone changes job, someone leaves. IT teams often call these joiners, movers and leavers. Handling each one in a deliberate way keeps access matched to reality.
Joiners: starting well
A new employee’s first day goes better when their accounts are ready, and security is better when those accounts are created from a standard pattern rather than by copying a colleague’s settings. Copying a colleague is tempting, but it also copies whatever extra permissions that person has gathered over the years.
A reliable joiner process typically looks like this:
- A trigger from the right source. Often the request comes from HR or the hiring manager, with a start date, job title, department, manager and employment type. Having a single trusted source avoids requests that arrive informally by chat.
- Account creation from a template. The job role defines the starting groups and applications. Anything beyond that requires a specific request and approval.
- Equipment and credentials. Devices are prepared and recorded in asset management so the organization knows who holds what. Initial passwords are delivered securely, and the new person is asked to set their own.
- Extra sign-in protection. Enrolling the person for multi-factor authentication on day one is far easier than doing it later.
- Orientation on rules. A short introduction to acceptable use and the relevant IT policies, including how to report a lost device or suspicious message.
Timing matters. Creating accounts a day or two early avoids the pressure that leads to shortcuts, though accounts for future starters should generally be kept disabled until the start date.
Movers: the step people forget
When someone transfers to a new team or takes on new duties, the natural reaction is to add the access they now need. The step that gets skipped is taking away the access they no longer need. Over several moves, a person can end up with a combined set of permissions that nobody ever deliberately approved, sometimes called access creep.
A good mover process:
- is triggered by an HR change or a manager request, not left for the person to raise
- adds the new role’s standard access
- removes the previous role’s access, with a short handover period if the work genuinely overlaps
- records the date and the approver
- checks mailbox, shared folders and group memberships, not only the main applications
Temporary assignments, such as covering for a colleague on leave, should have an end date set when granted, so they expire without anyone having to remember. Organizing access by job function through role-based access makes movers simpler, because changing the role changes the bundle.
Leavers: ending access completely
Offboarding is where mistakes carry the most risk, because a former employee may still hold working credentials, and the reason for departure can range from a friendly retirement to a dispute. The process should be the same in every case, with timing adjusted for circumstances.
Plan the timing. For a planned resignation, access may continue until the last day, with sensitive permissions reduced earlier if appropriate. For an urgent departure, access is usually removed at the same moment the person is told. Agree this timing with HR in advance.
Disable before deleting. Disabling an account stops sign-in immediately while preserving the data and mailbox for handover, legal or audit needs. Deletion can follow later, according to your data retention rules.
Cover everything the person touched. A checklist helps:
- the main directory or sign-in account
- email, including forwarding or delegation to a manager if appropriate
- single sign-on and any applications with separate logins
- remote access and virtual private networks
- shared passwords and shared mailboxes they knew about, which should be changed
- service accounts or API keys they created or knew
- multi-factor devices and registered phones
- company laptops, phones, badges and storage devices, returned and recorded
- files and documents they owned, reassigned to a manager
Remember what is not obvious. Browser-saved passwords, personal devices that were synced with company mail, third-party software-as-a-service tools set up by a team, and automation tied to the person’s name can all outlive the account.
Preserve what is needed. Before anything is wiped, confirm whether data must be kept, and who needs to take over files, calendar items or projects.
Check afterward. A few days later, review system logs for sign-in attempts on the disabled account. Failed attempts may be harmless, but they are worth understanding.
Keeping the process dependable
Make it a checklist, with a record. Each step should show who did it and when, which makes questions answerable later and helps with audits.
Connect it to HR data. The most dependable trigger is the official employment record. If HR systems and IT records disagree, accounts tend to be left active.
Include contractors and temporary staff. They are easy to leave out of HR-driven processes, yet often hold substantial access. Give their accounts an expiry date from the start.
Test with a periodic comparison. Compare the list of active accounts against the list of current staff. Anything on the first list but not the second needs an explanation. Running access reviews catches the ones that slipped through.
Mind the help desk. Requests often arrive through the IT help desk, so staff there should know the standard steps and who can authorize exceptions.
A reasonable standard
No process eliminates every gap, particularly where applications keep their own separate logins. But a clear trigger, standard roles, written offboarding steps and a periodic comparison against current staff go a long way toward making sure access starts promptly and ends when it should.