Agent WranglersAudit logs and access Required
Remove access within a day of leaving
Disable every account of a person who leaves within 24 hours of their last day, and rotate any shared secret they knew.
How to do it
Put every tool you can behind single sign-on, so one switch in the identity provider closes most doors. Keep a list of the tools outside single sign-on and close each by hand from a checklist. Rotate shared keys and passwords the person could read. Move their duties to a new owner first, as in named owners.
How to check
A script compares leaving dates from the HR system with the deactivation times in the identity provider and in each tool outside single sign-on. It fails when any gap passes 24 hours.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day.