Departing employees retain access to an average of 7 SaaS apps after leaving. Get a complete checklist for revoking SaaS access in 24 hours or less.
When an employee leaves your organization, IT follows a standard offboarding checklist: disable Active Directory or Google Workspace account, collect the laptop, revoke VPN access. Done.
Except it's not done. Not even close.
The average departing employee retains active accounts in 7 or more SaaS applications after their corporate identity is deprovisioned. These are accounts IT doesn't know about — classic shadow IT — tools the employee signed up for independently, connected via OAuth, or accessed with a personal email and a corporate-adjacent password.
Every one of these orphaned accounts is a security vulnerability. A disgruntled former employee, a credential-stuffing attack, or a vendor breach at any of these services could expose your company data months or years after the employee left.
The numbers tell the story:
Most mid-market companies rely on a manual offboarding process that looks something like this:
This process fails for several predictable reasons.
If your SaaS inventory is maintained in a spreadsheet, it's out of date. New applications are adopted weekly. People forget to update the sheet. Entire categories of tools — free tiers, trials, department-purchased apps — were never on it to begin with.
Spreadsheet accuracy for SaaS inventory averages 30-40%. That means 60-70% of a departing employee's SaaS accounts are invisible to the offboarding process.
Disabling an employee's Google Workspace or Azure AD account is necessary, but it's not sufficient. Here's why:
Most offboarding processes are designed around the applications IT knows about. There is no process for revoking access to shadow IT — because, by definition, nobody knows these applications exist until someone goes looking.
Even in organizations with mature offboarding procedures, shadow IT accounts are almost always missed.
Use this checklist to ensure comprehensive access revocation when an employee departs. The goal is to complete all steps within 24 hours of the employee's last day.
For each discovered shadow IT application:
For European companies, employee offboarding has specific GDPR implications that go beyond access revocation. Organizations subject to NIS2 face even stricter requirements for access control and incident handling.
Departing employees may exercise their right to erasure for personal data processed in SaaS applications. This includes:
The challenge: You cannot comply with an erasure request for applications you don't know about. SaaS discovery during offboarding ensures you can identify all locations where an employee's personal data may be stored.
GDPR requires organizations to maintain records of processing activities, including the categories of personal data processed and the recipients (including SaaS vendors). When an employee departs, review:
After an employee departs, continue processing their personal data only where necessary:
Delete personal data from SaaS applications where there is no ongoing legal basis for processing. This includes profile data, activity logs, and personal files in tools the employee used.
If an employee's data resides in SaaS applications hosted outside the EEA, ensure that:
Shadow IT offboarding is the step that most organizations miss entirely. Here's a focused approach:
Use email metadata analysis to identify every SaaS application associated with the departing employee's corporate email address. This catches:
Not all shadow IT accounts need the same level of attention. Prioritize by risk:
| Priority | Criteria | Action | Timeline |
|---|---|---|---|
| Critical | Accesses sensitive data (customer PII, financial, IP) | Immediate account deletion or lockdown | Within 2 hours |
| High | Has OAuth access to corporate systems | Revoke OAuth tokens, then delete account | Within 8 hours |
| Medium | Contains company data but limited access | Export data, delete account | Within 24 hours |
| Low | No company data, no corporate system access | Delete account when possible | Within 1 week |
For each discovered shadow IT application:
Manual offboarding at scale is unsustainable. A 200-person company with 10% annual turnover offboards 20 employees per year. If each employee has accounts in 15-25 SaaS applications (including shadow IT), that's 300-500 account revocations per year — most of them invisible to current processes.
Track these KPIs to assess and improve your SaaS offboarding process:
SaaS offboarding is a security imperative, not an administrative afterthought. Every departing employee who retains access to company data through unknown SaaS accounts is a breach waiting to happen.
The fix starts with visibility. If you can discover every SaaS account an employee has before their last day, you can revoke access comprehensively. Without that visibility, you're deprovisioning the accounts you know about and hoping for the best on the rest.
Hope is not a security strategy.
Want to see what a complete offboarding looks like? Book a demo and discover every SaaS account across your organization in 15 minutes.
Discover the most common shadow IT examples in the workplace, from unauthorized SaaS tools to AI apps, and learn how to manage them effectively.
Shadow IT costs mid-market companies millions in wasted spend and security gaps. Learn how to discover and manage unauthorized SaaS applications.
Build a SaaS governance framework that reduces risk, controls costs, and accelerates adoption. Proven policies and implementation strategies.