We need a repeatable way to remove departed employees from Active Directory and connected applications, but there is no written retention policy yet. Should accounts be disabled first, deleted right away, or handled on a schedule?
What should a sensible offboarding process do with user accounts?
Asked by
Q8+Clatter
Answers
Start by separating access removal from account deletion. Disable access promptly when someone leaves, revoke sessions and credentials where the systems support it, and remove physical access tokens. Then delete accounts only after the agreed retention period and any data-handling needs are settled.
Write down who approves the process, what happens to mail and files, how long disabled accounts remain, and how restoration works. The exact timeline depends on company policy, legal requirements, and operational needs, so get those owners to sign off rather than picking a number informally.
Reply to this answer
For a small company without an SOP, I would draft one rather than treating a manager's email as the whole policy. A practical workflow can disable the directory account, move it to a clearly named restricted location, revoke application access, and record the groups and systems that were changed. Keep the record somewhere access-controlled, not as an informal pile of exports.
Before deletion, confirm ownership or retention of mailboxes, files, and business records. A disabled account is not a substitute for a data-retention plan, and retaining it indefinitely also has security and housekeeping costs. Set a review date and have the appropriate business and compliance owners decide the retention period.
Reply to this answer
Don't forget the applications. Disabling an account in the directory may not revoke every app session, local account, API credential, or access token. Use an offboarding checklist that names each connected service and has a clear owner for confirming access is gone.
Automate the repeatable parts once the policy is approved, but make exceptions visible. A terminated user's account should not stay usable just because a downstream application was missed.
Reply to this answer
Some organizations delete accounts on a defined schedule, while others retain disabled accounts because of records, investigations, or operational requirements. Neither a blanket immediate deletion rule nor keeping every account forever is a safe default without knowing your retention obligations and recovery setup.
I'd make the proposal concrete: immediate disablement, data and access review, a documented retention period, then deletion with a tested recovery path. Ask management to approve the policy and exception process.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Q8+Clatter:
That distinction helps. I can propose the immediate access steps separately from the later cleanup schedule.