Give People the Access They Need—and Remove It Cleanly

Business access often grows through small urgent decisions. A contractor receives an administrator login to fix a problem. A founder opens an account using a personal address. A shared password stays in circulation after someone changes roles.

Bring those decisions into a simple operating process. The goal is for the right person to complete their work, for the business to retain ownership, and for access to change cleanly when responsibilities change.

Inventory the accounts that can stop the business

Start with domain registration, DNS, hosting, email, source code, payments, business software, analytics, and backups. Record the business owner, the administrative owner, the recovery route, and where access is managed.

Do not put passwords into the inventory document. Reference the approved credential store or access process. The inventory should help someone find the responsible person and the correct system without becoming a collection of secrets.

Check whether the organization controls the account and its recovery details. An invoice paid by the business does not necessarily mean the business can recover an account opened under someone else’s identity.

Match access to a defined responsibility

Describe the tasks each role needs to perform. A content editor may need to publish articles without installing software. An accountant may need reports without changing the payment integration. A temporary support contractor may need access for a limited period.

Use individual accounts where the service supports them so changes and actions can be attributed. Review administrative access separately, and give temporary access an end date and an owner who checks that it was removed.

When a platform has coarse permission levels, document the limitation and the compensating review process. Avoid pretending that an available role exactly matches the responsibility if it also grants broader powers.

Make sign-in recovery part of the setup

OWASP’s MFA guidance explains that multifactor authentication uses distinct factors and that recovery needs careful design. A reset process must help legitimate users regain access without becoming an easy way to bypass the protection.

For each critical account, record how an authorized person recovers access if a device is lost or the usual administrator is unavailable. Store recovery material through the approved process and limit who can retrieve it. Check that the recovery address or phone belongs to the intended owner.

Walk through the instructions with a second authorized person. Discovering an outdated phone number during setup is easier to resolve than discovering it during an outage.

Treat a departure as a coordinated handover

Microsoft’s employee offboarding guidance separates blocking sign-in, preserving information, transferring access to work, and later account or license removal. That separation matters: removing access and preserving business continuity are related tasks with different consequences.

Prepare a checklist suited to the person’s actual responsibilities:

• Identify accounts, devices, shared credentials, and external invitations.
• Assign a new owner for documents, workflows, subscriptions, and customer work.
• Revoke access and active sessions through the relevant services.
• Rotate shared secrets the person could access where appropriate.
• Review forwarding, delegated access, automation tokens, and recovery details.
• Record completion and any exceptions requiring follow-up.

Have the responsible business owner decide what information must be preserved before deleting accounts or removing services. Confirm platform-specific retention behavior instead of relying on a general assumption.

Review access when work changes

Do not wait for a departure. Promotions, project endings, supplier changes, and reorganizations can leave permissions that no longer match the work. Review critical accounts on a regular schedule and after significant changes.

Ask each owner to confirm who still needs access and why. Close the loop on uncertain entries rather than leaving them permanently marked “to check.”

LeapHover can help organize business account ownership, strengthen sign-in and recovery, and create onboarding and offboarding processes that fit the way your team works.