What’s the right way to revoke access when an employee or contractor leaves?

The long-term fix is reducing the number of things that need manual cleanup. Avoid shared accounts, permanent cloud keys, unmanaged SSH keys, and secrets pasted into chat. Tie access to a central identity, use short-lived credentials, and automate provisioning and deprovisioning. That way offboarding is mostly disabling one account, followed by a review for exceptions and any credentials that could not be centrally controlled.

For infrastructure, centralize SSH access instead of leaving public keys scattered across servers. A bastion host, a managed SSH system, or a session service such as SSM can provide a controlled entry point. Ideally SSH isn’t exposed directly to the internet, and access to databases happens through a VPN, tunnel, or identity-aware proxy. Removing the user’s central access should cut off network reachability even if an old database account hasn’t been cleaned up yet.

A written offboarding runbook is more important than a particular tool. At minimum, disable the identity-provider account, invalidate active sessions and tokens, revoke VPN and device access, remove group memberships, disable the company laptop, rotate any unavoidable shared secrets, and check for service-specific accounts or API keys. For normal departures, completing this within an hour may be sufficient; for sensitive or involuntary departures, access should be terminated immediately.

The best approach is to make access depend on a central identity provider rather than individual keys and shared passwords. Use SSO and MFA everywhere possible, map permissions to groups, and give people temporary cloud credentials through roles instead of permanent access keys. Then offboarding starts by disabling the person’s central account, which can revoke access across cloud services and internal systems at once.

Shared credentials should be treated as a risk that needs cleanup. Give users individual database accounts where possible, store application secrets in a proper secret manager, and use a business password manager for limited staging access. If a shared password really must exist, rotate it during offboarding and record that step in the checklist. Also make sure company laptops are locked or remotely disabled and that any local cloud credentials are revoked.