What breaks when someone leaves and nobody offboards them
Access outlives employment by default. That is the problem.
Onboarding gets attention because someone is waiting on it. Offboarding does not, because by definition the person affected has left and nobody is chasing. The result is that access accumulates: every company past its second year has credentials belonging to people who no longer work there.
Why it is worse than it sounds
It is not primarily about malice. The real risks are duller. An account nobody owns still has a password in a browser somewhere. A personal device holds a session token indefinitely. A shared login is used by four people and rotated by none. An integration authenticates as a departed employee and breaks the day their account is finally deleted.
That last one is why offboarding gets deferred: someone tries it once, something breaks, and the lesson learned is to leave accounts alone.
The fix for that specific fear
Before deleting anything, find the things that authenticate as that person. Scheduled jobs, integrations, API tokens, calendar automations, anything that uses their identity to act. Transfer those to a service identity that belongs to the company rather than a human.
Then suspending the account is safe, and can be done immediately, with deletion following later once nothing has broken for a while.
Export the audit log before you touch anything
This is the step people skip, and it is the only irreversible one. Login and admin audit retention is finite on every major platform, and suspending or deleting a user is exactly the moment you would want an unaltered record of what they accessed and when.
Export it first, store it outside the systems you are about to change, and only then start the cleanup. Everything else here can be undone. A log that has aged out cannot be recovered.
A short offboarding sequence
Suspend the identity provider account first, since it cascades to everything using single sign-on. Reset any shared credentials that person knew. Transfer file ownership before removing the account, because in several platforms deletion takes the files with it. Revoke tokens and application-specific passwords, which often survive a password change. Remove them from third-party systems that do not use your identity provider — this is the step most often missed, because those systems are invisible from the admin console.
Then check the ones you already missed
Every company starting this discovers a backlog. Run an access review across the main systems, list every account, and match it against current employees. The mismatches are the backlog. Work through them once, then run the review quarterly so it never gets that large again.
Make onboarding produce the offboarding list
The reason offboarding is hard is that nobody recorded what was granted. If onboarding is a checklist that gets saved per person, offboarding is that same list read backwards. That single change turns a research project into an administrative task.