A SaaS offboarding audit finds and removes ex-employee access in the three places it lingers most—cloud storage, project/CRM tools, and unsanctioned apps—then sets a simple review rhythm so those “zombie” logins don’t come back.
An employee leaves on Friday. By Monday, you’ve shut off their email and picked up their laptop.
What often gets missed is the project tool they joined last quarter, the cloud folder they shared with a vendor, or the CRM login tied to a role they had two jobs ago.
Months later, those sessions can still be live.
That’s how zombie accounts happen. Not because anyone is careless, but because most offboarding still focuses on company gear while daily work has moved to cloud apps. The average company now uses 100+ SaaS applications. Many checklists were written back when you had three.
What a Zombie Account Really Is
A zombie account is a still-working login for someone who no longer works for you. The nickname is casual. The exposure is not.
The danger is simple: these are valid credentials. The access was granted on purpose, so systems don’t flag it. If a former team member signs back in—or if their password is stolen after they leave—the door is still open.
Industry research finds that 50% of organizations have discovered former employees still using SaaS apps months after they left. In most cases, the discovery was accidental, not the result of a planned review.
Where Old Access Hangs Around
Cloud storage and collaboration
Google Drive, OneDrive, and Dropbox are where zombie access bites fastest.
This is where offboarding gets messy. Files end up shared to a departing employee’s personal email. Temporary guest access from a project never gets cleaned up. Folders set to “anyone with the link” may still be saved in a browser.
Turning off the user in your identity provider removes a license. It does not remove shared folders, external links, or personal-account shares.
Project tools and CRMs
Asana, Monday.com, Notion, Jira, HubSpot, and Salesforce often get set up by team leads, not IT. Your offboarding list may not even know they exist.
An ex–account executive’s Salesforce login or a project manager’s Notion workspace with strategy docs can sit untouched for months.
The apps no one tracked
This is the riskiest group.
These are the tools people signed up for with a work email: a survey site, an AI writing helper, a data visualization app. They were never formally assigned, so they were never formally removed.
When the person leaves, the account stays active—now tied to an inbox that may forward to an IT catch‑all.
How to Run a SaaS Offboarding Audit
Step 1: Build your app inventory
Start with a list of all SaaS apps connected to your identity provider: Microsoft Entra ID, Google Workspace Admin, or Okta.
Then cross-check billing records, installed browser extensions, and email domains that send regular login notifications.
Grip Security’s 2025 SaaS Security Risks Report, based on 29 million user accounts, found 23,987 distinct SaaS apps in use across its customers—and 90% of them sat outside IT’s management. No team can track that by hand.
No identity platform? For smaller teams, a focused 30‑minute sweep of active subscriptions and recent login alerts will surface most high‑risk tools.
Step 2: Match apps to recent departures
Pull the last 12 months of leavers and check each name against your app list.
For every platform, ask:
- Is there an admin area you can reach?
- Can you see who is active right now?
- When did this user last sign in?
If access is still active for someone who left months ago, that’s a zombie. Revoke it and note what you changed.
Step 3: Remove access, record it, and set a rhythm
Turn off the account. Capture what you found and when. Use the results to expand your offboarding checklist beyond email and laptops.
From here on, require two-step login (multi‑factor authentication) on the accounts that remain, and schedule a quarterly SaaS access review. That turns a one‑time cleanup into a simple, repeatable control for your team in and around Panama City.
Make Offboarding a Security Habit
Zombie accounts don’t fix themselves. A quick SaaS offboarding audit is the starting point, and a steady review cadence keeps access tidy across cloud storage, project tools, and those one‑off signups.
Sources and further reading
If you want help running a zombie SaaS audit and building a simple offboarding process your team can follow on every exit, get in touch with Flux Labs.
—
