In many organizations, yes—but not always automatically.
A well-designed employee offboarding process typically includes automatic revocation of access through an identity and access management (IAM) system. When an employee's status changes to "terminated" in the HR system, that change can trigger workflows that:
- Disable the employee's primary account (such as their corporate directory account).
- Revoke access to internal applications and cloud services.
- Invalidate active sessions and authentication tokens.
- Disable VPN, email, and remote access.
- Remove privileged roles and group memberships.
- Log the deprovisioning actions for auditing.
However, some organizations still rely on manual or partially automated processes. In those environments, delays or oversights can leave accounts active longer than intended, particularly for:
- Legacy applications that are not integrated with the central IAM system.
- Shared or local accounts.
- Third-party SaaS applications without automated provisioning.
- Physical access systems that require separate deactivation.
Whether access is revoked automatically depends on the organization's infrastructure and policies. If you're evaluating a specific company's controls, it's worth asking questions such as:
- Is HR integrated with the IAM platform?
- Is application deprovisioning automated across all systems?
- How quickly is access revoked after termination (immediately, within minutes, or manually)?
- Are exceptions monitored and audited?
- Are privileged accounts handled differently from standard user accounts?
Organizations with mature security programs generally aim for immediate or near-immediate automated access revocation to reduce the risk of unauthorized access after employment ends.
