Removing a person from a SaaS application is more than disabling one login. The account may own files, API tokens, shared integrations, administrative roles, automation credentials, or records the organization still needs. A good offboarding process removes unnecessary access without accidentally breaking operations or deleting information that must be retained.
Inventory access before removal
Identify the person's accounts, roles, groups, privileged access, active sessions, API keys, application passwords, delegated permissions, and connected services. Centralized identity can make this easier, but application-specific access still needs attention.
Transfer ownership deliberately
Reassign business-owned files, dashboards, scheduled jobs, shared mailboxes, repositories, workflows, and administrative responsibilities before deleting an account. Check whether integrations rely on a personal identity that should instead use a controlled service identity.
Revoke access and credentials
Disable sign-in, terminate sessions where supported, remove group and role assignments, revoke tokens, and rotate shared secrets that the departing person knew. NIST CSF 2.0 includes outcomes for managing identities and credentials and for managing access permissions and authorizations according to risk.
Preserve only what should be preserved
Security teams should coordinate with the appropriate business, privacy, legal, records, or compliance owners before deleting or retaining data. Operational convenience alone should not determine legal hold, employment-record, contractual, privacy, or regulated-retention decisions.
Verify completion
Use an offboarding record that shows systems checked, ownership transfers, credentials revoked, exceptions, responsible reviewers, and completion date. Periodic access reviews can help identify accounts that escaped the normal process.
Related knowledge
Continue with Privileged Access Reviews, Service Account Security, Secrets Management for Automated Workflows, and Zero Trust for SaaS Access.
References
This is general cybersecurity guidance and does not determine employment, legal, contractual, privacy, records-retention, eDiscovery, or regulatory obligations.