What Should Happen to Access When an Employee Leaves?
At 5:00 on Friday, an employee can hand back a badge and leave the building. Digital access does not disappear unless a system removes it.
That is why the termination event must trigger more than an HR status change.
When an employee leaves, the identity process should disable the account, revoke application access, remove privileged access and record the completed actions. The termination event should come from an authoritative source and trigger a governed leaver workflow. The goal is to prevent active or orphaned access from surviving after the employment relationship ends.
A 1-line HR status change is not the end of offboarding
Offboarding is complete only when digital access matches the person's new employment status.
Consider a project lead in Sydney who finishes employment on Friday. HR marks the person as terminated. The laptop return process closes. The central directory account gets disabled.
But what about a cloud application, a local account, a privileged role or access granted outside the core directory?
The 4-part Clean Exit
A clean exit needs four parts: disable, revoke, de-privilege and record.
- Disable: the identity or account path that should no longer authenticate.
- Revoke: application and directory entitlements tied to the former employee.
- Remove: privileged, administrative or elevated access with extra care.
- Record: each action and confirm the target systems completed it.
The fourth step matters because a requested removal and an executed removal are not the same thing. Your audit trail should show completion, not only intent.
Europe states the employment link in 2 clear duties
European cyber rules for covered entities connect access management to both termination and employment change.
Commission Implementing Regulation (EU) 2024/2690 says relevant entities should provide, modify, remove and document access rights. It also says access rights should be modified accordingly when employment ends or changes.
For financial entities under DORA-related delegated rules, access rights should be withdrawn without undue delay when employment ends or access is no longer necessary.
These requirements apply to defined scopes, not every organisation everywhere. They still show why leaver control has moved from a helpdesk concern into a governance concern.
Australia, India and the US: 3 control lenses for a leaver
Different regions use different legal and security models, but all benefit from accurate lifecycle data and controlled access removal.
Australia's Privacy Act framework includes 13 Australian Privacy Principles, including security and information quality. India's DPDP Rules 2025 put organisations into a new operational phase for personal-data governance. In the United States, CISA's Zero Trust Maturity Model describes automated lifecycles and dynamic least privilege as higher-maturity identity practices.
For your leaver process, the practical question stays the same: when the workforce source says the person has left, how quickly and completely does the access state follow?
The 4-question Leaver Proof Check
Run the Leaver Proof Check before you call an exit complete.
- Did the authoritative termination event trigger the workflow?
- Did user, application and privileged access receive the required removal actions?
- Did any approved exception receive an owner and end date?
- Can you prove the target systems completed each action?
A leaver ticket is not evidence of revocation. Completed revocation is evidence.
4 leaver mistakes that create orphaned access
A leaver process is only as complete as the least-visible system it covers.
- Disabling the central account and assuming every connected application follows.
- Ignoring privileged access because it is managed by another team.
- Leaving transition access open without a defined expiry.
- Archiving the identity record before confirming the revocation result.
Where Anugal fits
Anugal connects HR-driven joiner, mover and leaver events with governed identity actions. The workflow evaluates the workforce context and policy before access is created, changed or revoked, and records the lifecycle action.
That keeps the process practical: start with the workforce event, define the access decision, send the approved change to the target system, and retain evidence of what happened.
Frequently asked questions
When should employee access be revoked?
Your policy should tie the revocation to the authoritative termination event and the approved effective time. High-risk or privileged access deserves particular attention because leaving it active increases exposure.
Is disabling an account the same as revoking access?
No. Account disablement can block one authentication path, while the person may still hold access in other applications, local accounts or privileged systems. A complete leaver process checks the full access scope.
What is an orphan account?
An orphan account is an account or access path that remains active without a valid current owner or employment need. Leaver processes should identify and remove these paths rather than relying only on central account status.
What if the employee needs access after leaving for a handover?
Treat it as a specific exception with a business owner, narrow scope and fixed end date. Do not leave normal employee access active for convenience.
How does Anugal approach leavers?
Anugal states that leaver automation revokes user and privileged access, removes standing or orphaned access, executes consistent deprovisioning and generates offboarding evidence.
Next step
See how Anugal approaches governed leaver automation.
Prefer a direct conversation? hello@businesscoresolutions.com
