What to do if a former employee still has access

Don't stop at the account you found. If offboarding missed one system, it probably missed others. Work through the list below the same day, and record the time each step was done.

• Microsoft 365 / Google Workspace: block sign-in, revoke sessions, remove MFA methods, and remove them from groups and shared mailboxes. Convert or retain the mailbox rather than deleting it.
• SaaS apps not behind single sign-on: CRM, accounting, file sharing, project tools, social media, marketing platforms.
• VPN and remote access: accounts, certificates and any remote-control tools on their old machine or their home computer.
• Shared passwords they knew: Wi-Fi, admin accounts, vendor portals, alarm codes, password manager shared folders. Change them.
• Mobile devices: retire or wipe company data from phones still enrolled.
• Physical access: badges, keys, building codes.

This is the question that decides whether you have a security incident or just an admin gap. For Microsoft 365, the Entra sign-in logs show successful and failed sign-ins with time, IP address, location and app; the Microsoft Purview audit log shows what the account did, such as files accessed or downloaded, emails sent or read, and settings changed. Other systems have their own login history.

Look at the period since their last day. No sign-ins at all is the best outcome; record it. Sign-ins from their home city at odd hours, file downloads or forwarding rules are a different story.

• Export sign-in and audit logs for the period from their departure to now, for every system where access was found.
• Screenshot the account state (enabled, roles, groups, last sign-in) before changing it, or immediately after disabling it.
• Keep their mailbox and OneDrive or Drive under hold if there's any chance of a dispute.
• Write a short timeline of when the gap was found, by whom, and what was done.

If the logs show the account was used after departure, treat it as an incident. Establish what was accessed or downloaded, whether it included client or employee personal information, and whether anything was changed or deleted. A forensic examination can also look at where data went, for example whether files synced to a personal device.

If personal information was accessed without authorization, assess whether there's a real risk of significant harm, report and notify if so, and record the breach regardless. See What to do if you suspect an employee took company data for the evidence-preservation sequence.

It's tempting to call the former employee and ask. Speak to your lawyer first. An informal call can tip them off, prompt deletion of evidence, or create problems for later remedies. Counsel can decide whether a letter, an undertaking or something stronger is appropriate, and how employment and privacy law affect the approach. The Office of the Privacy Commissioner's guidance on privacy in the workplace is relevant to how you review an individual's account activity.

• One owner for offboarding, with a checklist that HR triggers on the last day, not after.
• Single sign-on for as many SaaS apps as possible, so one disable cuts most access.
• A list of apps and shared credentials each role uses, kept current.
• A password manager with shared vaults instead of shared spreadsheets.
• Quarterly access reviews to catch what the checklist misses. See Employee offboarding security checklist and Quarterly user access review checklist. Call the 24/7 line at (289) 582-9930 if the logs show the access was used.