What should be preserved before an employee account is disabled?¶

Preserve the employee account's identity, permissions, active access and relationship to organisational data and services before disablement changes them.

Map the account's organisational role¶

Record the employee identifier, username, email address, role, department, manager, tenant and account status. Capture active sessions, linked devices, authentication methods, administrator rights, groups and delegated permissions. Identify relevant email, messaging, cloud storage, VPN, business applications, audit events and security alerts.

Shared mailboxes, team folders, service accounts, scheduled processes and documents may depend on the account as owner or delegate. Record forwarding, out-of-office, device-management, licence and retention settings that an administrative workflow may alter automatically.

Balance access control with preservation¶

Disablement can terminate sessions, revoke tokens, stop synchronisation and trigger transfer, archive or deletion actions. Review the incident, legal, HR, safeguarding and continuity effects before acting. If immediate risk requires access to stop, preserve the visible state where practicable and use the narrowest effective control.

Document the authority, administrator, time, method, warnings and affected systems, and retain provider confirmations. Disablement does not prove the employee was the only user or ensure that copied data and alternative credentials are inaccessible.