How are remote access permissions removed when staff or suppliers leave?

Remote access permissions should be removed as part of a controlled offboarding process that links the person’s departure or supplier contract end to every system, device and service they could use remotely. The aim is not simply to close a named account, but to identify and eliminate indirect access routes, preserve appropriate business records and provide evidence that the change was completed.

A robust process normally starts with an authoritative leaver notification. Human resources, the relevant manager or the contract owner should confirm the person or supplier identity, the effective date, the systems involved and whether access must be withdrawn immediately or at a specified handover point. The instruction should be recorded in a service management or security system so that technical staff can work from an approved request rather than an informal email.

Before making changes, the organisation should compare the leaver’s details with its access inventory. This can include:

• remote desktop and virtual private network services;
• cloud administration portals and business applications;
• remote monitoring or management tools used by support teams;
• file storage, collaboration and document management platforms;
• firewall, networking and security consoles;
• mobile devices, laptops and other equipment used to connect to company resources; and
• supplier portals or systems operated on the organisation’s behalf.

This inventory is particularly important where a person has accumulated permissions over time or where a supplier has used a shared service account. Access may also be inherited through a role, delegated by another administrator or linked to a device certificate, authentication application or password manager. Reviewing the relationship between identities, devices and permissions helps expose routes that may not appear in a basic user-account report.

Offboarding should distinguish between an individual employee, a contractor and a supplier organisation. An employee may have access linked to employment systems and company equipment, whereas a supplier may have several named engineers, a contract-level account or permissions controlled by a third-party service desk. The contract owner should confirm which supplier contacts remain authorised and whether any credentials, support tools or stored secrets must be returned, transferred or replaced.

Privileged access requires additional care. If the departing person could administer servers, firewalls, cloud services or security platforms, the organisation should review the ownership of those systems and ensure that another approved administrator can perform essential tasks. Shared administrator credentials should not remain unchanged merely because they were used by several people. They should be transferred into an approved credential-management process and changed where the departing person may have known or stored them.

Company equipment should be dealt with alongside account offboarding. A returned laptop or mobile device may still contain cached credentials, active authentication sessions, remote support software or locally stored keys. The device should be identified by asset record, collected or isolated where appropriate, and assessed under the organisation’s normal secure return and disposal procedures. If equipment cannot be recovered, the risk should be recorded and compensating controls considered.

After the technical work, verification should be performed independently of the original request where practical. Useful checks include reviewing current sessions, authentication activity, remote-management inventories, recent sign-in records and administrative changes. The review should look for unusual access under alternative identities, old supplier accounts, duplicate accounts and connections from devices that were not included in the original inventory. Testing should be proportionate to the level of access and the sensitivity of the systems involved.

The offboarding record should show who authorised the change, when it was carried out, which systems were reviewed, what exceptions remained and who completed the verification. It should not contain passwords or other sensitive secrets. Keeping this evidence supports internal governance, security investigations and audit requirements without retaining unnecessary personal information.

Some departures require an exception process. For example, access may need to remain available briefly for a documented handover, legal hold or transfer of business ownership. Such exceptions should have a named owner, an end date and narrowly defined permissions. They should not rely on an informal agreement or leave a former user with unrestricted remote administration.

Regular access reviews reduce the risk of incomplete offboarding. Comparing the user directory, remote access platform, device register, supplier list and privileged-access records can identify dormant accounts before they become a problem. S2 Technology Group can help businesses around Stourbridge, Kinver, Wordsley, Kingswinford, Kidderminster, Halesowen, Dudley and neighbouring areas establish these processes, document responsibilities and verify that remote access remains aligned with current staff and supplier relationships.