When an employee leaves, HR completes the process, the badge is handed back, and the laptop is collected — and many companies assume the handover is done. But the real risks usually lie where no one is looking: can they still connect back to the company intranet? Have their email, shared drives, and accounts across various systems really been deactivated? Today we’ll make it clear exactly which access permissions must be revoked when someone leaves, why traditional approaches tend to leave gaps, and how to achieve “the moment they’re gone, every permission is cut off that same day.”
The Bottom Line First
The biggest risk in offboarding isn’t “forgetting to collect the laptop” — it’s the access permissions scattered across different places that are easy to overlook: remote access channels, shared files, email, and accounts for every kind of business system. If even one of them stays open, the departed employee (or anyone who gets hold of their account) may keep accessing company data. The right approach is to manage identities and access permissions centrally, so that offboarding is a single action that revokes all authorizations at once — not a manual deletion spree across a dozen systems.
What Goes Wrong When Offboarding Isn’t Clean
- Customers and data walk out the door: email, CRM, and cloud storage accounts still work, so customer records, quotes, and source code can be exported in seconds after they leave.
- Remote access channels stay open: VPN and remote access accounts were never disabled, so they can connect back to the intranet from home with the company none the wiser.
- Shared drives left exposed long-term: file servers are configured so that “anyone can get in,” and the departed employee’s computer or account keeps its access indefinitely.
- Compliance and audits don’t pass: MLPS 2.0 (China’s Multi-Level Protection Scheme) assessments and customer security reviews both check whether offboarding permissions were revoked in time, and any gap costs you points.
- Retaliatory deletion or tampering: in extreme cases, a disgruntled former employee uses leftover permissions to delete data or change configurations, causing losses that can’t be recovered.
Which Permissions Must Actually Be Revoked at Offboarding
Many companies watch only the laptop and the badge, but the items below are the ones that actually get missed. We recommend turning them into an offboarding access revocation checklist and ticking off each item:
| Category | What to Do |
|---|---|
| Remote access | Disable VPN, zero trust, and remote desktop accounts so the person can no longer reach the intranet from outside |
| Email and office tools | Deactivate corporate email, IM, and collaboration accounts; set an out-of-office auto-reply or forward messages if needed |
| Business systems | Disable or downgrade accounts one by one across CRM, ERP, finance, ticketing, code repositories, and more |
| Files and shared drives | Revoke access to file servers and cloud storage, and transfer the critical documents held under their name |
| Devices | Collect laptops and phones, and wipe the stored login credentials and certificates on them |
| Third parties and external services | Hand over accounts tied to personal identities, such as domains, cloud services, SaaS, and social media |
Why Traditional Approaches Always Leave Something Behind
- Accounts are too scattered: a dozen systems each have their own account structure, so offboarding means logging into each one to delete an account — miss one and you’ve got a risk.
- It depends on memory and manual work: with no checklist and no process, everything rests on the administrator remembering, and things get missed the moment they’re busy.
- Permissions are too coarse: in many systems, “once you’re in, you’re in everywhere,” which makes downgrading access hard — the only option is to shut the account down entirely, disrupting the handover.
- Nobody audits: there’s no way to know what a departed account can still access, or what that person last did.
The Right Approach: Unified Identity + One-Click Revocation
To solve this thoroughly, the key is to manage “who can access what” in one place instead of letting it scatter across individual systems. Here’s how to put it into practice:
- Unified identity entry point: employee access to intranet systems all passes through a single authentication layer, with accounts and permissions managed in one place.
- Least-privilege authorization: grant only the systems and machines a given role actually needs, rather than “get in and you can access everything.”
- One-click offboarding revocation: disable the person at the unified entry point and their access to every authorized resource is cut off immediately, with no manual deletion in each system.
- Fully auditable: who accessed what and when is all on record, giving you evidence for offboarding reviews and compliance checks.
For small and medium-sized businesses, the least burdensome option is a SaaS-based zero trust solution. Take sTrust as an example: employees must verify their identity before accessing intranet resources, business systems stay invisible to the public internet, and authorization is finely scoped by account and by resource. When an employee leaves, disabling the account in the admin console revokes their remote access in one click, effective immediately — no more logging into a dozen systems to delete accounts one by one. The control plane is hosted in China, has completed ICP filing, and supports MLPS 2.0 compliance; it’s delivered as software with no hardware to purchase, and direct connections within China stay stable. Companies in Beijing that want local implementation can also have Siwenlide deliver the identity system, networking, and remote access as a single package.
Three Things You Can Do Right Now
- Start with a checklist: list every system in the company that needs an account, and turn it into a single “provision on hire / revoke on exit” checklist.
- Revoke remote access first: disable VPN and remote access accounts the moment someone leaves — this is the most dangerous and most easily overlooked item.
- Consolidate over time: migrate scattered accounts into a unified identity entry point wherever possible, so every future offboarding can be cut off cleanly with one action.
Frequently Asked Questions
Q: An employee leaves — is collecting the laptop and changing the Wi-Fi password enough?
A: Far from it. As long as their remote access account, email, and system accounts still work, they can log back in from a different device. The point is to disable accounts and revoke permissions, not to collect hardware.
Q: We have too many systems and always miss an account when someone leaves. What should we do?
A: The fundamental fix is to manage identities and access permissions centrally, so that disabling someone at one entry point invalidates everything. In the short term, at minimum keep an offboarding revocation checklist and tick off each item.
Q:Can zero trust solve the problem of revoking access permissions when an employee leaves?
A:Yes. Zero trust turns “verify identity first, then grant access according to authorization” into a unified mechanism. When an employee leaves, simply disabling the account revokes all of their access to internal resources with one click, and the process is fully auditable.
Q:Our SME has no dedicated IT or security staff. How do we implement this?
A:Use a SaaS-based zero trust solution (such as sTrust). The software is simply activated with no hardware to purchase, and both account provisioning and revocation take only a few clicks in the admin console. Alternatively, you can hand it to an IT Operations Services provider to configure and maintain it for you.
Still worried that a departed employee is “gone but can still connect back”?
sTrust Zero Trust remote access: a unified identity entry point, fine-grained authorization by account and by resource, one-click revocation that takes effect immediately when an employee leaves, business systems kept invisible to the public internet, support for MLPS 2.0 (China’s Multi-Level Protection Scheme), software activation with no hardware purchase, and stable direct connections within China. Visit strust.siwenlide.com for a free trial; Beijing-based enterprises can call 400-686-2011 or visit siwenlide.com for local deployment.
