Chicago Businesses: Did Former Employee Access Leave When the Employee Did?

"A former employee may still have a digital key to your business."

Click the image to view the guide.

An employee leaves the organization. Their laptop is returned, payroll is updated, and coworkers are notified.

But can that person still open company email, download files, view client records, or connect remotely?

For many Chicagoland organizations, the honest answer is unclear. That uncertainty matters because employee access rarely exists in one place. It may be spread across Microsoft 365, cloud storage, customer relationship management software, finance applications, vendor portals, and remote-access tools.

A complete offboarding process should remove or transfer every point of access on the employee’s final day.

Why former-employee access gets missed

Most lingering accounts are not left active on purpose. They remain because offboarding responsibilities are divided among several people and systems.

Human resources may notify payroll. A manager may collect the laptop. IT may disable the primary email account. Yet no one checks a departmental application, an old file-sharing platform, or temporary vendor access created for a past project.

Common gaps include:

• A cloud application that is not managed through a central directory
• A password saved on a personal device
• Temporary access with no expiration date
• A shared account whose password was not changed
• Administrator permissions that were never removed
• An account belonging to a contractor or former vendor
• A paid software license that remains assigned

The former employee may have no intention of using the account. The problem is that the organization no longer has reliable control over who can reach its systems.

What an active account may still expose

A forgotten login can hold more access than leaders realize.

Depending on the employee’s role, the account may allow someone to read internal messages, open sensitive records, edit files, download reports, reset other passwords, or connect to business systems from outside the office.

The impact may be especially serious for Chicago-area healthcare, insurance, education, government, and nonprofit organizations. These teams often manage protected, regulated, financial, or personally identifiable information.

The risk is not limited to deliberate misuse. An abandoned account could also be compromised by someone else, particularly when it has a weak password, old authentication settings, or little active monitoring.

Use a same-day offboarding checklist

A repeatable checklist reduces the chance that an important step depends on memory.

When an employee or contractor leaves, the process should include:

1. Block sign-in to the primary company account.
2. End active sessions on computers, phones, and browsers.
3. Revoke authentication methods, saved tokens, and remote access.
4. Transfer email, files, calendars, and application ownership.
5. Remove access to cloud applications, finance tools, and customer systems.
6. Review and remove administrator permissions.
7. Change passwords for any shared accounts the person used.
8. Recover, lock, or remotely secure company devices.
9. Remove unneeded software licenses.
10. Record who completed and verified each task.

The timing matters. When possible, HR, the employee’s manager, and IT should agree on the exact departure time before the final day.

Look for accounts that have already been forgotten

Offboarding improvements will protect future departures, but they may not reveal accounts left behind in the past.

A lightweight cybersecurity assessment can begin by comparing current staff and contractor records with the active-user lists in your major systems.

Review:

• Microsoft 365 and other email platforms
• Cloud storage and collaboration tools
• CRM and case-management applications
• Accounting and finance software
• VPNs and remote-support platforms
• Industry-specific systems
• Vendor and partner portals

Flag accounts with little recent activity, no clear owner, administrator privileges, or names that do not match current personnel records. Shared and generic accounts also deserve attention because they can make individual activity harder to trace.

Consistent Microsoft 365 management helps, but the review should extend beyond Microsoft. Any application that stores business information or connects to another system belongs on the list.

Give each department a clear responsibility

Offboarding works best when ownership is defined before someone submits a resignation.

HR should begin the process and confirm timing. The employee’s manager should identify systems, records, and work that need to be transferred. IT should remove access, secure devices, and document completion. A manager or security lead should verify that no exceptions were overlooked.

No single department has the entire picture. The process must connect people, technology, and business operations.

Can you prove the access was removed?

The best offboarding question is not, “Did IT disable the email?”

It is, “Can we verify that every account was removed, transferred, or intentionally retained?”

Reintivity helps Greater Chicago organizations identify forgotten accounts, improve access controls, and create repeatable offboarding procedures across Microsoft 365, cloud applications, devices, and business systems.

When the employee leaves, their access should leave with them.