An employee resigned, should I close all their accounts immediately? How much should I rush?

close it immediately, don't wait at all. you'll close all access within an hour after the last day. disable AD, revoke VPN set up mail forwarding, take backup but if the employee is problematic it's even more urgent. btw close github/aws all one by one...

Offboarding checklist: 1) Active Directory: disable user + reset password, remove from antivirus product, 2) Email: set up forwarding rule (to manager or archive), 3) Cloud resources: delete/revoke AWS IAM user, suspend Google Workspace, disable Azure AD, 4) VPN/SSH: remove public key, revoke certificate, 5) Third-party apps: revoke Slack workspace admin, remove GitHub collaborator, 6) Physical: deactivate badge, collect laptop/phone, revoke SIM. Automation: identity management platform (Okta, Azure AD) single sign-off (disabling user automatically revokes all app access). Knowledge transfer: documentation, code repo handoff, escalation contacts.

hurry up, whenever the employee leaves all access will be cut off that day (end of day)... set up email forwarding to another admin, take a file backup this is mandatory. i mean if company data stays on their device it'll be a problem, they might have copied the whole company...

Offboarding phases: 1) Pre-departure (notice period): knowledge transfer, asset inventory, data backup, 2) Departure day: access revocation, asset collection, device wipe 3) Post-departure: access audit, data archive, email retention (compliance). Ceremony: exit interview (departing employee survey) compliance checklist signature. Automation: SIEM log monitoring (flagging former employee activity) alerting. Audit trail: access logs retained for 6-12 months (compliance investigation).

15 years in IT management, I've made this mistake many times. Late access revocation when an employee leaves = risk of data theft. Best practice: restrict access even during the notice period, remove access by end of the departure day, no delays whatsoever. Keep email forwarding for 1 year, then delete. Company must keep a backup of files.

The opposite happened to me, that's why I'm writing. Trying to do this alone is the most expensive way.

If I were you, I'd go this route.

I went through the same thing two years ago. Forgotten test environments are more often the entry point than live systems.

If I were you, I'd go this route.

It's rare to find an explanation this clear. When we decide without measuring, we always end up in the same place.

Correct me if I'm wrong.

Let me speak from the other side; I'm on the supplier side. Don't hesitate to ask; those who don't ask always pay more.

If you have questions, write them; I'll answer as best I can.

this approach has a cost which isn't discussed... when you try to change everything at once, nothing settles.

trying to do this alone is the most expensive way then this is my opinion, I'm not claiming it's absolute truth.

You're right.

We need to make a distinction here. The answer varies greatly by industry; there is no one-size-fits-all rule.

Of course, it varies if your situation is different.

Exactly like that. The real issue isn't the number, but what it's based on.

Correct me if I'm wrong.

I've been down this road, let me tell you. People defend habits, not processes. Resistance comes from there.

Forgotten test environments are more often the entry point than live systems. Correct me if I'm wrong.

I'll try it. Having backups accessible on the same network and with the same identity makes them part of the target.

The answer varies greatly by industry; there is no one-size-fits-all rule. If you post the result here, it will help others too.

There's a part I don't understand. Start with a small trial; don't commit to everything at once.

Payment information changes are never verified through the channel they came from. Of course, it varies if your situation is different.

Just a heads-up. An untested backup is not a backup.

Everyone rushing into closing access when employee leaves gets stuck at the same point. Good luck with that.

Let me clarify the technical side. If you scold false alarms, nobody will report again.