Why Former Employees Should Not Keep Administrator Access

Most offboarding checklists stop at the laptop, the parking pass and the final payslip. What they rarely cover is the small, scattered set of logins that have accumulated over the years in a staff member's name. Facebook Business Manager. The Google Business Profile. The Mailchimp tenant. The WordPress admin. The shared Instagram login. The DNS provider. Each of these is a quiet potential incident.

The problem is not that former staff are generally malicious. Most are not. The problem is that access that outlives the role is access that has no current owner. If the account is compromised later, nobody is paying attention. If the person has a sudden grievance, the business is exposed on a dozen fronts at once.

The Shape Of The Risk

A departing marketing manager who stays an administrator on Facebook Business Manager can, on a bad day, remove the business from its own Page. A former office manager who was a global administrator on Microsoft 365 can, if the account is not revoked, forward mail to a personal address and keep reading internal conversations for months. A contractor who built your WordPress site and was never removed can push changes to the live site. A former bookkeeper who still has advisor access to Xero can see your current numbers.

The worst stories are rarely about brilliant hackers. They are usually about ordinary people who still have logins they should not have, and a stressor that turned a dormant account into an active problem.

Where To Look

Social: Facebook Business Manager, Instagram accounts, LinkedIn Company Page administrators, TikTok Business accounts, YouTube channel managers. The shared Instagram login that was emailed around in 2019 is almost certainly still in half a dozen notes applications.

Email and identity: Microsoft 365 user accounts, Google Workspace user accounts, email aliases that forward to a personal address, shared mailboxes with delegated access, mobile app passwords, OAuth app connections to the mailbox.

Website and infrastructure: WordPress administrators, hosting account users, domain registrar logins, DNS provider administrators, Cloudflare organisation members, CDN accounts, SSL certificate issuers.

SaaS and operations: Xero and MYOB users, Stripe dashboard access, booking platforms, CRM users, project management tools, Slack or Teams workspaces, file storage administrators, SMS gateway accounts, review platform logins.

Google and Meta: Google Business Profile owners and managers, Google Ads accounts, Google Analytics properties, Google Tag Manager containers, Google Search Console verified users, Meta Business Suite assets, Instagram shopping access.

The Shared Login Problem

'We just share the login' is a pattern that quietly accumulates in businesses that grew faster than their systems. One Instagram login shared across the marketing team. One generic 'bookings@' mailbox everyone knows the password for. One 'office@' email forwarded to half the staff. When somebody leaves, there is no remove-user step, because there is no user. The password simply walks out with them.

The remediation is to change the password at the provider, immediately, and ideally to replace the shared account with individual accounts where the platform supports it. For accounts that cannot be split, rotate the credentials after any departure and keep a note of when it was last changed, not the credential itself.

Why Removal Has To Happen At The Provider

A register of who has access is useful. It does not revoke anything on its own. Removal happens by signing into the provider, locating the user and removing them, confirming the removal, and recording that the action was done.

Some platforms make this easy. Microsoft 365, Google Workspace, Facebook Business Manager and Xero all have straightforward administrator interfaces. Others are awkward. A legacy WordPress site may require a database change if the admin account was created in an unusual way. A shared account with no individual users requires a password change.

A task that says 'remove access' is not done until someone has verified the user no longer appears in the provider's admin list. Verification is part of the process, not an optional extra.

The Role Of Multi-Factor Authentication

If the former staff member had multi-factor authentication tied to their personal phone, removing their account also removes the second factor. Any shared account they held still has the problem that their old phone is a valid authenticator. Rotate shared account passwords, remove any device-based tokens, and re-enrol multi-factor authentication on current staff devices.

If you suspect account misuse after departure, preserve logs before mass password changes where possible, then contain. Evidence and containment can both matter, and the order depends on how time-sensitive each is.

The Timing Question

The best time to remove access is on the final day. The second-best time is the quarterly review. The worst time is after an incident.

Where a departure is amicable and planned, revocation can happen as part of the exit interview. Where a departure is sudden or difficult, revocation is urgent and should be done before the person leaves the building. Where the departure is historical, catching it at the next review is better than catching it never.

Dormant Users Still Hold Risk

Access reviews should include dormant users who have not signed in for months but still hold privilege. Unused admin seats are still risk. A dormant account can be compromised through credential stuffing and used to escalate, and nobody will notice because nobody expects that account to be active.

Pending invitations are also worth looking at. An unused invitation sitting in a provider's console is a pathway back into the system that nobody is monitoring.

A Short Scenario From Melbourne

A design studio in Melbourne discovered during a quarterly review that a contractor who finished a project in 2022 was still listed as an administrator on their WordPress site, their SendGrid account and their domain registrar. The contractor had done nothing wrong. He had moved on to full-time work at another studio and had forgotten the logins existed. The studio removed him from all three accounts, documented the action, and discovered during the removal that his SendGrid account had been used to send a small volume of mail two months after his contract ended. Nothing malicious; a legacy automation he had set up was still running under his credentials. Had the credentials been revoked at the end of the engagement, the discovery would not have been a surprise two years later.

A Second Scenario From Perth

A disgruntled employee at a hospitality venue in Perth deleted the business's main Instagram account on their last day. The password had been shared with every member of the marketing team, and nobody had changed it when the employee gave notice. Instagram's recovery process took six weeks and the audience was partially rebuilt from scratch. The direct cost of the lost reach was estimated by the venue at several thousand dollars. Rotating a password at 5pm on the day notice was given would have prevented the entire incident.

Building The Habit

Pair every departure with a short list: identify every system the person had access to, remove them where you can, rotate shared credentials, confirm multi-factor authentication is intact on remaining accounts, and record what you did and when.

Then, independently of departures, run a quarterly review of administrator access across the main systems. Ask three questions per account: does this person still work here, does this person still need this level of access, and when was this last confirmed. Answer in writing. Keep the history.

Culture Matters Here

Businesses that treat access review as mistrust make staff defensive. Businesses that treat it as ordinary hygiene get better compliance. Frame it as protecting customers and continuity, not as a comment on anyone personally. The person being removed from a stale account usually did not know they still had access and is often relieved to have it tidied up.

How Business Vault Fits

Business Vault records who has access to each asset, who is internal and who is external, and when the record was last confirmed. The platform does not sign into Facebook or WordPress on your behalf to remove users; where there is no API, it shows the steps and keeps the record of the decision. The register and the review schedule together are what turn a one-off clean-up into a repeatable habit.

Former access is one of those risks that costs almost nothing to prevent and a disproportionate amount to recover from. The quarter of an hour it takes to run the check is a small payment against a much larger possible bill.