Leaver

Eventually, every employee lifecycle reaches its final stage.

Someone leaves Wire Finance.

That might happen through resignation, retirement, the end of a contract, dismissal, or a higher-risk departure where access needs to end immediately.

At first, the objective seems obvious:

disable the account.

But that is only one part of the problem.

What about active sessions?

Privileged identities?

Exception access?

Assigned group memberships?

Application permissions?

Licences?

Corporate devices?

Shared resources?

Business documents or services owned by the employee?

A Leaver process therefore has to do more than switch off a user account.

It has to make sure that access ends while Wire Finance remains in control of its information, devices, and business resources.

The Leaver Process

Wire Finance uses a controlled offboarding process to identify, remove, recover, transfer, and validate everything associated with a departing employee.

Conceptually:

Confirmed Departure
        │
        ▼
Departure Risk + Timing Confirmed
        │
        ▼
Business Handover Identified
        │
        ▼
Sign-In Blocked
        │
        ▼
Sessions Revoked
        │
        ▼
Normal + Assigned Access Removed
        │
        ▼
Privileged Identity Reviewed
        │
        ▼
Licences + Devices Recovered
        │
        ▼
Ownership Transferred
        │
        ▼
Final Access Validation
        │
        ▼
Leaver Closed

The process begins with an authorised business event.

HR confirms that the employee is leaving and establishes the effective date and time.

The manager identifies any business handover requirements.

IT removes or disables technical access and recovers company-managed resources.

Security becomes involved where privileged access, elevated risk, or investigation requires additional coordination.

The real outcome is not:

Account disabled.

It is:

access removed, company assets recovered, business ownership preserved, and the departure validated as complete.

Not Every Departure Is the Same

Wire Finance does not treat every Leaver event identically.

The urgency of access removal depends on the circumstances surrounding the departure.

Leaver Type	Example	Access Removal Approach
Planned voluntary departure	Employee resigns with notice	Schedule removal for the agreed end date and time
End of contract	Employment or contract reaches its approved end date	Schedule removal where possible
Retirement	Planned end of employment	Schedule removal and business handover
Involuntary termination	Employee is dismissed	Coordinate access removal for the exact termination time
High-risk termination	Security, fraud, or misconduct concern	Immediate or tightly coordinated containment
Abandonment / No-show	Employee stops attending work	Follow an HR-authorised suspension or termination process

The difference matters because access removal needs to match the business and security risk.

A planned departure provides time to prepare ownership transfer and device recovery.

A high-risk departure may require access to disappear before normal handover activities occur.

Planned and High-Risk Departure Paths

The two broad paths can look very different.

A planned departure allows Wire Finance to prepare:

Departure Confirmed
        ↓
End Date + Time Agreed
        ↓
Business Handover Prepared
        ↓
Ownership Reviewed
        ↓
Device Return Arranged
        ↓
Termination Time Reached
        ↓
Access Removed
        ↓
Final Validation

A higher-risk departure changes the order of priorities.

High-Risk Departure
        ↓
HR + Security + IT Coordination
        ↓
Exact Termination Time
        ↓
Sign-In Blocked
        ↓
Sessions Revoked
        ↓
Privileged Access Removed
        ↓
Security Review
        ↓
Business Recovery + Handover

The business handover still matters.

But it should not require leaving risky access active.

Disable the Identity at the Correct Time

The standard employee identity is one of the first controls that must be addressed.

For example:

olivia.carter@wirefinance.com

or the equivalent account in the current Wire Finance tenant.

At the approved termination time, Wire Finance should prevent the identity from continuing to authenticate.

Conceptually:

Employment Relationship Ends
        ↓
Standard Identity
        ↓
Sign-In Blocked

For a planned departure, this should happen at the agreed end time.

For a high-risk departure, the timing may need to be coordinated precisely between HR, IT, and Security.

The important principle is:

technical access should end when the authorised business relationship ends.

Disabling the Standard Identity Is Not Enough

An employee may have many relationships beyond the primary user account.

Their identity may be associated with:

• company-wide access
• department membership
• role membership
• applications
• data permissions
• collaboration resources
• assigned pilot groups
• licence groups
• exception access
• privileged identities
• administrative assignments
• active sessions
• corporate devices
• business-resource ownership

The real Leaver question is therefore not:

Has the user account been disabled?

It is:

Have all of the person’s access relationships been identified and handled?

Dynamic and Assigned Membership Need Different Treatment

Wire Finance uses both dynamic and Assigned group membership.

That distinction matters during offboarding.

Normal organisational relationships such as company, department, and job role are designed around trusted attributes and dynamic membership.

Examples include:

• SG-BASE-ALL-STAFF
• SG-DEPT-FINANCE-USERS
• SG-DEPT-HR-USERS
• SG-DEPT-OPERATIONS-USERS
• SG-DEPT-SALES-USERS
• SG-DEPT-IT-USERS
• SG-ROLE-*

When the workforce relationship ends and the identity is no longer an active employee, those organisational memberships should no longer continue to represent valid access.

Assigned groups require a different approach.

They may include relationships such as:

• pilot participation
• licence assignment
• exception access
• privileged administrative access

Those assignments need to be reviewed and deliberately removed where appropriate.

Conceptually:

Dynamic Organisational Membership
        ↓
Identity no longer qualifies
        ↓
Membership reevaluated

Assigned Membership
        ↓
Leaver Review
        ↓
Explicit Removal

This prevents access from surviving simply because an Assigned membership was forgotten.

Remove Pilot and Licensing Assignments

A departing employee should no longer consume services or remain part of controlled deployment populations without a reason.

During the current Wire Finance pilot, examples include:

SG-PILOT-IDENTITY

and:

SG-LICENCE-M365-E5

These are deliberate assignments.

They should therefore be included in the Leaver checklist.

Conceptually:

Departing Employee
        │
        ├── SG-PILOT-IDENTITY
        │       └── Remove
        │
        └── SG-LICENCE-M365-E5
                └── Remove when appropriate

Removing the licensing assignment allows the licence to be recovered for reuse.

Offboarding is therefore both a security process and an environment-maintenance process.

Exception Access Ends Too

Exception access should not survive the employment relationship simply because it was previously approved.

For example:

SG-EXCEPTION-PAYMENT-PROCESSING

may have been completely legitimate while an employee worked in an authorised role.

Once that relationship ends, the justification for the exception ends with it unless there is an explicitly documented reason otherwise.

Approved Exception
        ↓
Employment Ends
        ↓
Business Justification Ends
        ↓
Exception Removed

Exception access should therefore be explicitly checked rather than assumed to disappear automatically.

Privileged Identities Must Be Checked Separately

Some Wire Finance employees may have both a standard identity and a separate privileged identity.

For example:

jordan.lee
        ↓
Everyday employee identity

adm-jordan.lee
        ↓
Privileged administrative identity

Disabling the standard identity does not prove that the privileged identity has also been handled.

The privileged path must therefore be reviewed separately.

Departing Administrator
        │
        ├── Standard Identity
        │       └── Block sign-in and remove normal access
        │
        └── Privileged Identity
                ├── Block or disable privileged identity
                ├── Remove PAG memberships
                ├── Remove active administrative roles
                ├── Remove eligible assignments
                └── Validate administrative access is gone

Relevant privileged-access groups may include:

• PAG-ENTRA-SECURITY-READER
• PAG-DEFENDER-SECURITY-OPERATOR
• PAG-INTUNE-ENDPOINT-ADMIN

Depending on the employee, the review may also need to consider:

• Microsoft Entra administrative roles
• Microsoft Intune administrative access
• Microsoft Defender permissions
• Azure role assignments
• application administration
• eligible privileged assignments
• other elevated capabilities

The principle is simple:

standard and privileged identities are separated during employment, so they must also be handled separately during offboarding.

Active Sessions Must Be Revoked

Blocking future sign-in is necessary, but Wire Finance should also consider sessions that already exist.

The desired Leaver state is:

Sign-In Blocked
        +
Active Sessions Revoked
        +
Assigned Access Removed
        +
Exception Access Removed
        +
Privileged Access Removed

This provides stronger assurance that the former employee cannot simply continue using an existing authenticated session after the business relationship has ended.

For higher-risk departures, session revocation becomes especially important because containment is the immediate objective.

Authentication Methods Need Review

The departing identity may also have registered authentication methods associated with it.

Examples could include:

• authenticator registrations
• security keys
• other approved authentication methods

Wire Finance does not need to turn the lifecycle page into a detailed authentication procedure, but those relationships should be considered during final account closure.

The exact authentication-method controls will be implemented later within Microsoft Entra.

At the lifecycle-design level, the principle is:

a closed identity should not retain an unmanaged authentication path that could later cause confusion or risk.

Recover Corporate Devices

Identity access is only part of offboarding.

The employee may also possess a Wire Finance-managed endpoint.

The Leaver process therefore needs to identify:

• which device is assigned to the employee
• whether the device has been physically returned
• whether local or cached access needs to be considered
• whether the device should be reassigned, rebuilt, retired, or investigated
• whether security evidence needs to be preserved before remediation

Conceptually:

Employee Leaves
        ↓
Assigned Corporate Device Identified
        ↓
Device Recovered
        ↓
Security / Business Review
        ↓
Reassign, Rebuild, Retire, or Preserve

The detailed endpoint lifecycle is handled later in the Device Provisioning Model.

The Leaver process simply establishes that a departing employee’s identity cannot be considered fully closed while company devices remain unaccounted for.

Business Data Still Belongs to Wire Finance

Removing access does not mean deleting everything associated with the employee.

A departing person may own or manage resources that the organisation still requires.

Examples include:

• business documents
• mailbox information
• Teams or collaboration resources
• SharePoint content
• reports
• application-owned records
• shared resources
• automated processes
• groups or resources where the employee is an owner

Those relationships should be reviewed before permanent account deletion or cleanup.

Where necessary, ownership should be transferred to:

• the employee’s manager
• another authorised employee
• an application or data owner
• another appropriate business owner

This creates an important distinction:

Employee Access
        ↓
Must End

Business Information
        ↓
Must Remain Under Organisational Control

The principle is:

employment ends and access ends — but Wire Finance retains control of its business information.

Disable First, Delete Later

Immediate access removal and permanent identity deletion are not the same thing.

In many cases, Wire Finance may need the identity to remain available for a period while:

• ownership is transferred
• required data is preserved
• mailbox or collaboration content is handled
• security investigation is completed
• audit information remains accessible
• business-retention requirements are satisfied

The Leaver process should therefore distinguish between:

ACCESS TERMINATION
        ↓
Immediate or scheduled security action

PERMANENT IDENTITY DELETION
        ↓
Later lifecycle action after required checks

This prevents the organisation from deleting an identity before it has dealt with the resources and evidence connected to it.

The exact retention period is a business and compliance decision and does not need to be invented as part of this lab design.

High-Risk Departures May Require Security Preservation

Sometimes the departure itself may be connected to a security concern.

In those situations, immediately wiping or altering every device or resource could destroy information needed for investigation.

A high-risk departure may therefore require coordination between HR, IT, and Security before destructive actions are taken.

Conceptually:

High-Risk Departure
        ↓
Contain Access
        ↓
Preserve Relevant Evidence
        ↓
Investigate Where Required
        ↓
Recover / Remediate Assets

Containment and evidence preservation may need to happen before normal device reuse or cleanup.

This will become more important later when Wire Finance begins using Defender and Sentinel for investigation and response.

Validate Before Closing the Leaver

The Leaver process should never end simply because someone clicked Block sign-in.

Before closure, Wire Finance should be able to confirm:

• the departure date and time were authorised
• the standard identity can no longer sign in
• active sessions were revoked
• expected dynamic access no longer applies
• assigned groups were reviewed
• pilot access was removed
• exception access was removed
• the privileged identity was separately handled
• PAG memberships and administrative assignments were removed
• licences were recovered where appropriate
• required applications and resource permissions were reviewed
• corporate devices were accounted for
• business-resource ownership was transferred
• required data was preserved
• any necessary security review was completed
• remaining access was validated as removed

The validation should answer one final question:

Can this former employee still reach anything that should have ended with the employment relationship?

If the answer is uncertain, the Leaver process is not complete.

The Lifecycle Is Complete

We started with a person entering Wire Finance.

The Joiner process turned an approved hire into a working identity.

Approved Hire
      ↓
Create the right identity
      ↓
Establish the right access

The Mover process recalculated that access when the employee’s responsibilities changed.

Business Change
      ↓
Remove what is obsolete
      ↓
Add what is newly required

The Leaver process closes the relationship safely.

Employment Ends
      ↓
Contain access
      ↓
Remove entitlements
      ↓
Recover assets
      ↓
Transfer ownership
      ↓
Validate closure

Together:

JOINER
Give the right access
        │
        ▼
MOVER
Keep access aligned
        │
        ▼
LEAVER
Remove access and preserve control

That completes the Wire Finance identity lifecycle.

We now understand:

• what identities exist
• how they are named
• how access is organised
• what normal access should look like
• how privileged access is separated
• how identities join the organisation
• how access changes when responsibilities change
• how access is removed when the relationship ends

But identities do not operate in isolation.

Employees need devices from which to access company resources, and those devices need their own identity, management state, security controls, and lifecycle.

The next part of the Wire Finance journey therefore asks:

How should corporate devices be identified, provisioned, managed, trusted, and eventually retired?

That takes us into the Device Provisioning Model.

---

← Back to Identity Lifecycle

← Mover

Device Provisioning Model →