Deprovisioning

What it is

Deprovisioning is the process of taking away a person's access to company systems when they no longer need it. Most of the time this happens when an employee leaves, but it also applies when someone changes roles or a contractor finishes a project.

It covers more than email. Deprovisioning includes business apps, shared drives, building badges, laptops, phones, admin rights and any accounts the person created on behalf of the company. It is the opposite of user provisioning, which gives new hires the access they need on day one.

Why it matters

Every account left open after someone leaves is a door that nobody is watching. A former employee, or anyone who gets hold of their password, could still read customer data, download files or send messages in the company's name. Many companies only notice these leftover accounts during an audit, long after the person has gone.

There is also a cost side. Paid software seats often keep billing until someone removes the user. Clean deprovisioning keeps your data safe, your license count accurate and your records ready for compliance checks.

How it works

Deprovisioning usually starts as soon as HR confirms a last day. It is one part of the wider employee offboarding process. A typical sequence looks like this:

• HR records the exit date and triggers the IT tasks.
• IT lists every system the person can access, often from the HR system or identity provider.
• Shared files, mailboxes and ownership of key accounts are moved to a manager or colleague.
• Access is switched off at an agreed time, usually at the end of the last working day.
• Devices, keys and badges are collected and wiped or reset.
• Someone checks that every account is closed and logs the result.

Example: a sales rep leaves on Friday. On Monday HR sets the exit date in the HR system. On Friday at 5pm their single sign-on (SSO) account is disabled, which blocks most apps at once. IT then removes the two tools not connected to SSO, transfers the CRM accounts to their manager and wipes the returned laptop.

Best practices

• Keep an up-to-date list of the systems each role uses.
• Connect as many apps as possible to one identity provider so one switch closes most doors.
• Put deprovisioning steps on a shared offboarding checklist with a named owner for each step.
• Agree the exact cut-off time with the manager before the last day.
• Use offboarding software to trigger IT tasks automatically when HR records an exit.

Common mistakes

• Disabling email but forgetting tools bought by a single team.
• Deleting accounts before important files and contacts are handed over.
• Forgetting shared logins and passwords the leaver knew.
• Not checking contractors and freelancers, who often leave without a formal exit.

FAQ

What is the difference between provisioning and deprovisioning?

Provisioning gives a person the accounts and devices they need to do their job. Deprovisioning removes that access when they leave or no longer need it. Both work best when they are tied to the same HR records.

When should deprovisioning happen?

For most voluntary exits, access is removed at the end of the last working day. For dismissals or high-risk roles, it often happens at the moment the person is told. The rule is simple: no access should outlive the need for it.

Who is responsible for deprovisioning?

IT usually does the technical work, but HR starts the process and managers confirm what needs to be handed over. Many of the biggest offboarding mistakes happen when each team assumes another one has it covered.