Identity & Access Management · Lesson 6 of 8
Offboarding beyond the directory
Offboarding removes access when the approved trigger occurs. It also protects needed business records and continuity according to policy.
One disabled account is only one check
Fictional contractor departure. Follow authorized timing and policy.
| Access or asset | Required check | Why it matters |
|---|---|---|
| Directory account | Disable and verify | Check the central identity path |
| Separate analytics account | Remove access and verify | Do not assume directory integration |
| Sessions and tokens | Handle under platform guidance | Address remaining authenticated access |
| Business records and jobs | Preserve or transfer ownership | Keep required records and services available |
Read the visualWhy check a separate analytics account after disabling the directory?
Independent access can remain unless it is explicitly removed and verified.
Confirm scope and timing
Use an authorized departure signal and follow the organization’s timing rules. Coordinate sensitive departures with appropriate staff.
Cover access paths
Address central and local accounts, active sessions, tokens, remote access, and physical access through their owners.
Preserve and verify
Transfer business ownership where needed, preserve records according to policy, and verify removal. Do not indiscriminately delete shared resources.
Put it in context
A departed contractor has a directory account and a separate analytics account. Closing only the directory task leaves a gap if the analytics tool is not integrated.
Offboarding is complete only when the relevant access paths are verified.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.