SaaS access governance: Does access end when employees leave?

Cybersecurity Awareness Month encourages organizations to examine the controls behind everyday security habits. Training helps employees spot phishing and use strong authentication but does not resolve gaps in systems that govern access. Many organizations manage employee access through an identity provider (IdP) and single sign-on (SSO). However, not every AI or SaaS application connects to those systems. Other access paths, including shared credentials and OAuth connections, may require separate controls, especially when they provide access to company-owned resources that outlive an individual account.

Employees join companies, change roles, and leave every day. Contractors, seasonal employees, and business partners use many of the same applications. Each transition can change what access a person has or should have. Consider a contractor who connects an AI application to company documents during a project. When the engagement ends months later, IT disables the contractor’s account in the IdP. But who revokes the application’s OAuth access? Who transfers ownership of connected files? Who verifies the connection is no longer active? If those steps rely on a spreadsheet or a message to an application owner, that is an access governance gap.

According to 1Password’s 2025 Access-Trust Gap Report, 38% of employees have successfully accessed a former employer’s account. This finding reminds us that access can outlive the role it was created for, accruing cybersecurity and non-compliance costs.

This October, security awareness should include the systems behind employee behavior. Effective SaaS governance helps IT discover applications and access paths across connected data sources. It governs access beyond SSO and creates repeatable workflows for onboarding, role changes, and offboarding.

Why employee access persists after people leave or change roles

When an employee leaves, IT may disable their primary account and assume the process is complete but work rarely happens in one system. A former employee may still have an account in a project management tool, customer relationship management system, file-sharing platform, or AI application. If those tools are not connected to single sign-on (SSO), disabling the central account does not remove access.

Personal accounts, shared credentials, and OAuth connections can create additional paths back to company data. OAuth connections allow a third-party application to access company resources, and those permissions can persist until someone revokes them.

Role changes create a different version of the same problem. An employee moves from sales to marketing and receives access to new systems, but keeps permissions from their previous role. A contractor finishes a project but retains access to the workspace where the work took place. In each case, the access remains because one system recorded the transition while a different team managed the permissions.

Often with these scenarios, no one sees the full picture of what a person accesses, who owns it, or when it should end. Access governance closes that gap by connecting the employee event to every application and resource involved.

5 SaaS governance best practices for employee access

1. Discover the applications and access employees use

Governing access starts with visibility. IT and security teams need to know which applications, accounts, credentials, files, and integrations teams use for work.

That inventory should include applications outside SSO, OAuth connections and the permissions they grant, shared credentials, personal accounts used for work, and SaaS or AI applications adopted without formal approval. IT needs to have visibility in order to change or revoke unnecessary access.

2. Connect access workflows to employee lifecycle events

Onboarding, role changes, contractor end dates, and terminations should trigger defined access workflows.

Connect these events to provisioning and deprovisioning processes with clear ownership across HR, IT, security, managers, and application teams. Automate repeatable actions where supported, and define an exception process for applications that require manual review.

Record when each action is complete, and escalate anything that fails, remains unresolved, or requires an application owner to intervene.

3. Apply least privilege when roles change

Access should reflect a person’s current responsibilities, not their history with the company.

When an employee changes teams or roles, remove permissions associated with their previous work and review access to sensitive systems. Check privileged access, transfer ownership of files and workflows, and document the changes for future access reviews.

A role change is an access event, even when the employee remains trusted. This review reduces accumulated permissions and makes it easier to identify access that no longer has a business justification.

4. Govern newly adopted SaaS and AI tools

Employees adopt new AI and SaaS applications every day, often without IT approval. These tools can access company data, create new integrations, and introduce access outside SSO.

IT and security teams need visibility into what those tools can access, along with a clear process for requesting and approving them. AI program managers should be able to introduce useful tools without creating an unmanaged exception to the organization’s security process.

A governance process for new SaaS and AI applications should connect discovery with data-use policies, third-party connection reviews, and an owner for every approved application. It should also give employees and teams a clear way to request, approve, and remove access.

AI tools should be governed as part of the broader SaaS environment, not treated as a separate category with separate visibility and controls.

5. Verify access removal after offboarding

Offboarding is complete when the organization can show that it removed access from every relevant system.

That review may include applications outside SSO, active sessions where supported, OAuth and other third-party connections, shared credentials, files and workflows, application ownership, and licenses or paid seats.

Require evidence of completion and maintain a review trail. Use a second reviewer for higher-risk departures or users with privileged access.

IT teams should also test the offboarding process regularly. A scheduled test can reveal gaps in application coverage, unclear ownership, or failed automation before those gaps affect a real departure.

Together, these practices make access governance part of the employee lifecycle rather than a task someone remembers at the end of it. For any departure, IT teams should be able to name what access existed, who closed it, and when.

How 1Password SaaS Manager supports employee access governance

1Password SaaS Manager helps IT teams close access gaps across the employee lifecycle. It streamlines onboarding and offboarding across the SaaS environment by connecting HR and identity systems to automatically provision and deprovision applications, including apps outside SSO.

Through 400+ supported integrations, teams can automate provisioning, deprovisioning, access requests, and access reviews. Depending on the integration, workflows can also support actions such as OAuth token revocation, license removal, and ownership transfer.

SaaS Manager also discovers managed and unmanaged SaaS and AI applications, including shadow IT and AI tools employees adopt without IT approval. It can even surface OAuth connections and the permissions they grant, helping IT and security teams review and revoke access outside SSO. It inventories applications, accounts, licenses, and contracts, and supports access reviews and license management so IT and security teams can govern the tools employees use.

For IT teams, security awareness starts with visibility into employee access. Cybersecurity Awareness Month is a useful moment to review the applications, accounts, and workflows that need to change when people join, move, or leave.

Want to learn more?

Learn how SaaS Manager identifies onboarding and offboarding gaps and automates employee access and app management beyond SSO.

Explore the solution