--- title: "Does the Applicant terminate computer access promptly when employee/contractor leaves?" url: https://insuranceposture.com/questions/governance-and-workforce/applicant-terminate-computer-access-promptly-when-employee-contractor-leaves category: "Governance and workforce" canonical_key: q_gov_008 evidence_state: partial updated: 2026-08-24 --- # Does the Applicant terminate computer access promptly when employee/contractor leaves? URL: https://insuranceposture.com/questions/governance-and-workforce/applicant-terminate-computer-access-promptly-when-employee-contractor-leaves Section: Governance and workforce Evidence state: Partly verifiable from your tenant Disabling the account is the first step and not the last. Sessions, tokens, and access held outside your directory all survive it. ## What the carrier is actually asking The carrier is asking whether access is removed promptly when an employee or contractor leaves. Promptly generally means the same day, and for involuntary departures, at the moment of notification. ## Why it is underwritten Former employee access is a persistent exposure with no monitoring attached. It is also the mechanism behind a category of insider incidents that occur weeks after departure, when the organisation has stopped thinking about the person entirely. ## Where the answer lives in Microsoft 365, Entra ID, and Azure Deprovisioning outcomes are measurable in the directory, which makes this more verifiable than most governance questions. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Entra ID | Accounts belonging to departed staff and their enabled state | Disabled promptly, verified by reconciling the directory against the current workforce list | | Entra ID | Session and refresh token revocation on departure | Sessions revoked, since disabling an account does not immediately end an existing session | | Entra ID | Guest accounts held by the leaver in partner tenants | External access removed, which no internal process usually covers | | Microsoft 365 | Mailbox delegation, forwarding, and shared mailbox access | Delegated access removed, since it survives the account being disabled in some configurations | | Third-party systems | Software-as-a-service accounts outside single sign-on | Applications not federated to the directory, which is where former access persists longest. Attested | **Applications outside single sign-on keep working** Disabling the directory account stops federated access. An application with local credentials that was never federated continues to work indefinitely, and it is usually the one a departing employee remembers. The remediation is federating everything, and the interim control is an offboarding checklist that names those applications. ## What a defensible yes requires - Departure triggers deprovisioning through a process that runs whether or not a ticket is raised. - Sessions and tokens are revoked, not only the account disabled. - Applications outside single sign-on are covered by an explicit checklist. - Contractors follow the same process as employees. - Reconciliation between the workforce list and the directory happens periodically to catch misses. ## How this answer goes wrong The process is driven by a manager raising a ticket, so it works for planned departures and fails for the ones that matter. Or the account is disabled while a personal device continues to sync mail on an existing token that nobody revoked. ## If this answer turns out to be wrong The attestation clause you sign lives in this block, and its wording decides whether your answers are treated as representations or as something stricter. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### How fast is prompt? Same day for routine departures, immediately for involuntary ones. Carriers rarely define it and claims reviews reveal it. ### Should accounts be deleted or disabled? Disable and retain for a period. Deletion destroys forensic evidence and can break ownership of files and applications. ### What about mailbox access afterwards? Convert to a shared mailbox or delegate access to a manager rather than leaving the account enabled, which is the common shortcut. ### How do we verify the process works? Reconcile the directory against the current workforce list quarterly. It reliably finds accounts the process missed. ## Related questions - [Are all accounts associated with legitimate processes or current users (no orphaned/stale)?](https://insuranceposture.com/questions/access-control/accounts-associated-legitimate-processes-current-users) - [Are users able to access email through a non-corporate (BYOD/personal) device?](https://insuranceposture.com/questions/access-control/users-able-access-email-through-non-corporate-device) - [Are job applicants screened (credit, criminal records, drug testing) as permitted by law?](https://insuranceposture.com/questions/governance-and-workforce/job-applicants-screened-as-permitted-by-law) - [Is service provider access to network/data restricted on least-privilege basis, reviewed periodically?](https://insuranceposture.com/questions/third-parties/service-provider-access-network-data-restricted-least-privilege-basis) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.