Removing Access for Terminated Employees: A Termination-Day Plan
Gregg DavisUpdated 10 min read
Most departures give IT time. Someone resigns, works out their notice, and their access ends at the close of the last day.
An involuntary termination doesn’t work that way. The person learns about it in a meeting, and from that moment, any access they still hold is a risk you can’t size. Most people who are let go simply leave. You can’t know in advance which ones won’t, and the window is cheap to close.
This article is about that day: how to plan the termination with HR and the manager, when to cut access, the order to revoke it in, the evidence to keep, and what changes compared with a planned resignation. For the full list of what to remove from every leaver, see our guides to deprovisioning and the IT offboarding checklist.
Why Termination Day Is Different
A resignation is announced by the employee, with notice. IT has days or weeks to plan, the work is open, and access ends on a date everyone knows.
A termination is announced by the company, usually without warning. Three things change.
- The timing is fixed by a meeting. Access has to end at a set time on a set day, not at the end of a working day.
- The work is confidential. Until the meeting, only a few people should know. A ticket visible to the whole IT team, or a group removed the day before, can tip the employee off.
- The stakes are higher. An upset former employee with working credentials can delete data, copy it, or send messages in the company’s name. A termination is also more likely to be disputed later, so what you did and when matters as evidence.
For the wider security picture, including how to judge the risk of different departures, see data security during offboarding.
Before the Meeting: Plan With HR and the Manager
Termination day goes smoothly when the plan is made before it, by a small group.
Keep the Group Small
The plan usually involves HR, the manager, one named person in IT, and security or facilities for physical access. For a termination for cause, or anything likely to be disputed, legal should be involved too.
Keep the work out of shared queues. If the employee works in IT, or can see help desk tickets or directory changes, plan through a channel they can’t see.
Agree the Time and the Signal
Agree the exact time of the meeting, who in IT will act, and how they’ll get the go-ahead. A phone call or a direct message from HR when the meeting starts is enough. IT shouldn’t be guessing from a calendar invite.
Inventory the Person’s Access
Before the day, list everything the person can reach, without changing any of it yet:
- Their directory account, group memberships and admin roles.
- Applications that sign in through SSO, and those with their own logins.
- Remote access: VPN, remote desktop gateways, jump hosts.
- Shared accounts and passwords they know, service accounts they own and API keys they issued.
- Devices assigned to them, and their badge and any keys or alarm codes.
Prepare the commands or scripts you’ll run, so termination day is execution, not research.
Plan for Privileged Users
Terminating an IT administrator needs extra care, because they may hold the access you’ll use to remove theirs. Have a second administrator ready to act, and plan to rotate every admin, break-glass and service credential they knew straight after the meeting.
When to Cut Access
Cut access just before the meeting starts, or as it begins. Don’t do it hours earlier, because the employee shouldn’t learn about the termination from a locked account. Don’t wait until after the meeting either. Any gap between the conversation and the revocation is the window you’re trying to close.
Remote employees need one more step. If the meeting runs over Teams on the company laptop, disabling the account can end the call. Hold it by phone, or on a link that doesn’t depend on their company account, and cut access as the conversation begins. Our guide to remote employee offboarding covers equipment recovery and the rest of the remote process.
The Order of Revocation
On the day, work from the access that reaches the most systems to the access that reaches the fewest.
1. Disable the Directory Account and SSO
Start with the account everything else hangs from. In a hybrid environment, Microsoft’s guidance for revoking access in an emergency is to disable the user in on-premises Active Directory and reset their password twice.
The disabled state then has to reach Entra ID. Entra Connect Sync runs every 30 minutes by default, according to Microsoft, so run a delta sync (Start-ADSyncSyncCycle -PolicyType Delta) instead of waiting for the next cycle. If you use a separate SSO provider, deactivate the user there too.
2. End Sessions and Tokens
A disabled account can’t sign in again, but sessions that are already open keep working. In Entra ID, Revoke sessions invalidates the user’s refresh tokens. Access tokens already issued stay valid until they expire, which is an hour by default, unless the application supports continuous access evaluation.
Applications that issue their own session cookies keep them until they expire, or until the application itself ends the session. Delete any app passwords too, so legacy mail clients stop connecting.
3. Remove MFA Methods
In the Entra admin center, Require re-register MFA deletes the user’s phone numbers, Microsoft Authenticator apps and software OATH tokens, and deactivates hardware OATH tokens, according to Microsoft. If the account is ever re-enabled by mistake, their phone won’t let them back in. Collect any hardware security keys in the meeting.
4. Close Remote Access and Devices
VPNs that authenticate with certificates or local accounts may not notice a disabled directory account. Disconnect any active VPN or remote desktop session, revoke the user’s certificates, and remove them from jump hosts.
Disable the user’s registered devices in Entra ID, and lock their phone and laptop through your device management tool. Hold off on wiping them until HR and legal agree, for the reasons below.
5. Rotate Shared Credentials
Change the password of every shared account the person knew, along with service account passwords, API keys and vault entries. This step is easy to miss because none of it shows up under the person’s name. A privileged access management tool makes it faster, because it records who could see each secret.
6. Handle Applications Outside SSO
Applications with their own logins, vendor portals, payment and banking portals, social media accounts and domain registrars don’t follow the directory. Work through the list you prepared, with an owner for each, and confirm each one is done.
7. Revoke Physical Access
Deactivate the badge at the same time as the account, coordinated with facilities or security. Change any door or alarm codes the person knew, and collect keys, badge and devices in the meeting if they’re on site.
The Legal and Evidence Side
A termination is the departure most likely to end in a dispute, so how you remove access matters as much as how fast.
Disable, Don’t Delete
Disabling cuts access and keeps the data. Deleting can destroy mail, files and logs that HR, legal or an investigation may need. In Microsoft 365, a mailbox is kept for 30 days after the account is removed and then permanently deleted. If a hold is applied before the account is deleted, the mailbox becomes an inactive mailbox and is kept, according to Microsoft. Ask legal whether a hold is needed before anyone deletes anything.
Don’t Wipe Devices Too Soon
A wiped laptop can’t be recovered. If there’s any chance of a dispute or an investigation, lock the device, recover it, and let legal decide whether to image it before it’s reset. Record who handled it and when.
If the person used a personal phone for work, remove only the company data and apps. Intune can wipe corporate data from managed apps without touching the rest of the phone.
Record Every Step With a Timestamp
Log when the go-ahead came, when each account was disabled, which sessions were revoked, which credentials were rotated and who did each step. If data turns up later, or the termination is challenged, you can show that access ended at a known time and how. Rules on monitoring, personal data and record keeping vary by country and state, so agree your approach with legal in advance.
Don’t Let Them Log In to Collect Personal Files
Former employees often ask for photos or personal documents from their laptop or mailbox. Have HR handle the request and IT retrieve the files. Re-enabling the account, even briefly, undoes the work.
What’s Different From a Planned Resignation
| Planned resignation | Involuntary termination | |
|---|---|---|
| Who knows in advance | IT, HR, the manager and the employee | A small group, not the employee |
| When access ends | At the close of the last day | Just before or as the meeting begins |
| How work is tracked | An ordinary offboarding ticket | A private plan, outside shared queues |
| Knowledge transfer | During the notice period, with access intact | Through the manager, after access is cut |
| Device recovery | Returned on or before the last day | Collected in the meeting, or recovered remotely |
| Evidence | A standard offboarding record | Timestamped steps, holds and device custody |
The two can overlap. If someone resigns to join a competitor and the company asks them to leave the same day, treat it as a termination. The steps for every other departure are in the IT offboarding checklist.
After the Day
The urgent part is done once the person can’t sign in, but the deprovisioning isn’t. In the days after, handle the mailbox and files according to policy, reclaim licenses, and recover any equipment that didn’t come back.
Check sign-in logs for attempts from the disabled account in the following weeks. A post-departure review catches anything the plan missed, such as an application nobody listed.
Every termination also shows where your process was slow. If it took a phone call and a script to cut access, automating employee offboarding from your HR system makes the next one routine.
How ezOnboard Helps on Termination Day
ezOnboard handles the directory side of a termination from your HR system. HR stays the source of truth, and nobody needs to file an IT ticket that others can read.
When HR records the termination, your offboarding rules take over. ezOnboard disables the account in Active Directory and Entra ID, removes group memberships, reclaims Microsoft licenses and forwards mail. Agree with HR when the termination will be entered, and check when your rules act on it, so the directory side lines up with the meeting.
Every change is recorded with the HR event and the rule behind it, which gives you the timestamped record a termination needs. Safety rails stop a run that would disable more accounts than your limits allow, before it changes anything.
The rest of the plan, such as revoking sessions, removing MFA methods, closing remote access, rotating shared credentials and deactivating badges, stays with your team. ezOnboard takes the directory part off their list.
Book a demo to see it with your own HR system, or check the ROI calculator to see what it could save you.
FAQs About Removing Access for Terminated Employees
Should you disable an account before or after telling the employee?
Disable it just before the meeting starts, or as it begins. Doing it hours earlier tells the employee before HR does. Doing it afterwards leaves a window in which they still have access and know they’re leaving.
How quickly does disabling an account in Active Directory reach Microsoft 365?
Entra Connect Sync runs every 30 minutes by default, so a disabled account can still work in the cloud until the next cycle. Run a delta sync to push the change at once, then revoke the user’s sessions in Entra ID.
Does disabling an account sign the user out everywhere?
No. It stops new sign-ins. Revoking sessions invalidates refresh tokens, but access tokens stay valid for up to an hour by default, and applications with their own session cookies keep them until they expire.
Should you wipe a terminated employee’s laptop?
Lock it straight away, but don’t wipe it until HR and legal agree. A wipe can’t be undone, and the device may be needed as evidence. For a personal phone, remove only company data.
Can a terminated employee still access their work email?
They shouldn’t. Their account is disabled and their sessions revoked, so they can’t sign in. The mailbox itself is kept, and is forwarded, delegated or held according to your retention policy.
How is a termination different from a resignation?
A resignation is planned in the open, and access ends at the close of the last day. A termination is planned in confidence by a small group, and access ends at the moment of the meeting, with more evidence kept.