When employees leave, switch departments, or change roles, their old user accounts often get overlooked. These “orphaned accounts” can sit quietly in Active Directory or cloud services, still holding access to sensitive systems, apps, or data—long after they’re no longer in use.
Why It Matters:
Orphaned accounts are a low-hanging fruit for attackers. If an ex-employee’s credentials are still valid—or worse, tied to privileged access—they could be exploited in a breach, either through credential stuffing or insider threats. These accounts also muddy your compliance posture and make audits harder.
So, what can you do?
- Implement a Deactivation Checklist
Make account review part of every offboarding process. Disable or delete credentials across local AD, Azure AD, email, VPN, and cloud apps. - Use Group-Based Access Controls
Assign permissions via security groups rather than individual users. That way, when you remove someone from a group, their access is instantly revoked. - Run Monthly Directory Audits
Use PowerShell, LDAP queries, or tools like Microsoft Entra ID, JumpCloud, or Okta to pull reports on inactive users. Flag any accounts unused in 30+ days. - Watch for Shadow Accounts
Look out for duplicate or test accounts created by IT staff. If they’re not documented or in use, disable them. - Automate Where Possible
If you're using HRIS integrations or identity platforms, set up automated triggers to disable accounts based on employment status.
Log and archive account changes. This helps when troubleshooting access issues and provides an audit trail for security reviews or compliance.