Disabling an account in the directory (Entra ID / Active Directory) blocks sign-in, but not necessarily the delegations, forwarding rules, OAuth applications or Teams channel memberships that employee had accumulated. Offboarding Express checks precisely what remains active, beyond the directory.
A disabled account is not the same thing as an employee fully cut off from your systems
Blocking sign-in in the directory stops direct access, but the delegations the employee held on shared mailboxes or the forwarding rules they had configured can remain active independently of the account.
An employee may have authorised third-party applications (calendar, CRM, browser extensions) that keep access to company data independently of their user account.
Membership of teams, channels and the associated shared files often persists long after the last working day, with no alert to flag it.
Without a systematic check at every departure, these residual access rights pile up over the years and become forgotten entry points, invisible from the directory.
A multi-rail verification engine, the same one as in the SYAGA M365 audit, applied to an employee departure
Name of the employee who has left (or is leaving) and the planned access end date. No installation is required on the customer side.
Our engine queries the Microsoft Graph, Exchange Online, Teams and Purview rails to find delegations on shared mailboxes, automatic forwarding rules, OAuth consents and Teams channel memberships.
Sensitive identifiers are pseudonymised before any analysis. No raw data is copied or retained on our servers: only the measurement is sent back.
You receive a report listing each area checked with its status (cut off / active / to be verified), together with recommendations to permanently close whatever remains open.
A concrete report on the real state of an account's access, beyond the status shown in the directory
Detailed status (cut off / active / to be verified) for each of the areas checked on the account concerned.
Technical record of the check performed, useful in the event of an internal review or an incident linked to a former account.
Prioritised list of actions to carry out on the customer side to permanently cut off the access identified as active.
Managing access when an employee leaves features in the usual security frameworks
Appropriate technical and organisational measures to ensure the security of personal data. Effectively revoking the access of an employee who has left contributes directly to this security obligation.
ANSSI's IT hygiene guides recommend rigorous management of accounts and access rights, including their complete removal when employees leave.
Managing access rights throughout an employee's lifecycle, including removing them when the contract ends, is among the organisational controls covered by the standard.
A systematic review of residual access when an employee leaves is part of a general cyber risk management approach, without in itself constituting a specific regulatory obligation.
A personalised quote in every case - no price shown here is set in advance
A single departure, on request
Frequent departures, built into your HR/IT process
Multiple tenants, subsidiaries, large volumes
Two French authorities frame this subject: ANSSI for IT security, the CNIL for data protection. Here is what they actually say, without exaggeration.
No law sets a numerical deadline (there is no obligation of the "48 hours to cut off access" type). It is a requirement of result, carried by two official frameworks: when an employee leaves or changes role, their access must be revoked, without unjustified delay. An important nuance to keep in mind so as not to confuse recommended good practice with a legal obligation.
The IT hygiene guide of ANSSI (French National Cybersecurity Agency) devotes an entire measure to this subject, with no distinction of company size:
A free support scheme ("Aidant cyber") even exists specifically for organisations with no dedicated IT department, that is, the majority of very small and small and medium-sized businesses.
The CNIL (French Data Protection Authority) links this same subject to data protection, in its fact sheet on managing authorisations:
This fact sheet is addressed to any organisation that processes personal data: in practice, any company that has employees, customers or prospects in its IT tools.
Measure no. 6 of the guide lists what a departure procedure must cover, at a minimum (exact text):
ANSSI recommends an up-to-date inventory of accounts with extended rights (administrator, access to other people's directories), because they are attackers' preferred targets:
In practical terms: the administrator account of the website, the business email system or the online accounting software deserves a systematic check at every departure, even in a small organisation.
Neither ANSSI nor the CNIL sets a numerical deadline (no legal "48 hours" or "7 days"). Both texts use an obligation of result: rights must be revoked "at the time of departure" (ANSSI) or "as soon as" the person is no longer authorised, and "at the end of their contract" at the latest (CNIL). It is a security and data protection recommendation issued by two official authorities, not an article of law with a precise figure to comply with. The CNIL also points out, as a mistake to avoid: "forgetting to delete the user accounts of people who have left the organisation or changed role."
Beyond the general principle, here are the precise actions expected, who validates them, and how often, as described by the official texts.
ANSSI recommends defining a formal departure procedure, in conjunction with human resources, that covers at a minimum:
The CNIL links the revocation of access to its fact sheet on managing authorisations, which specifies that any granting of a right must have been validated by a manager:
In a small organisation with no dedicated IT department, this role falls in practice to the business owner or to the person who manages access to the company's digital tools.
This is the only numerical frequency found in the official texts consulted: the CNIL recommends a periodic review of authorisations, at a specific minimum frequency:
This review makes it possible in particular to spot access forgotten after an employee leaves, access that slipped through the net during the departure procedure.
The GDPR requires the controller to take "all useful precautions" to preserve the security of data (Article 32). It is a real legal obligation, but worded in terms of appropriate measures: it does not, in itself, indicate the procedure to follow when an employee leaves. It is the ANSSI and CNIL recommendations above that provide the concrete instructions.
No text imposes a deadline in hours for cutting off the access of an employee who has left: neither a legal "48h" nor "24h". However, two precise, sourced requirements do exist: revoke access "at the time of departure", without waiting (ANSSI), and review all authorisations at least once a year (CNIL) to catch whatever may have been forgotten. It is this double check, immediate after each departure and verifiable over time, that Offboarding Express offers.
Simple answers, each backed by a verifiable official source (ANSSI, CNIL)
On this subject, there is no single article of law that lists everything. It is two French authorities, ANSSI for IT security and the CNIL for data protection, that publish official recommendations. Here is what they actually say, without exaggeration.
Contact us to receive a personalised quote.
Free analysis of your domain: syaga.eu/scan. The free tool “Is my Microsoft 365 under attack?” is coming.
contact@syaga.eu