Job it-leavers-with-live-access-found-across-accounts-and-apps · revised 12 October 2026
Find people who have left but still have an account or seat in your apps
A list of people who have left but still have an active account, seat or token in each app you name, with the export row behind every entry, and unlisted accounts shown apart.
You might be seeing
- Nobody can say how many former staff still have a login somewhere
- Each app has its own user list and no one compares them
No passwords, keys, card details or admin invites needed to start.
What usually happened
People leave in one system and stay in the rest. Each app keeps its own user list, so a former employee can hold a seat, a token or a login in places nobody reviews.
Who it’s for: Managing director or IT lead after an ex-employee still had access, or before an audit, insurer or customer review.
Usually starts when: A leaver's account turned up months after they left, or someone asked how you know former staff cannot log in.
The result: You receive a list of leavers who still have an active account in your directory or in any named app, one row per person and system, with last sign-in and the export row it came from. A question list for the owner follows. Nothing is disabled or changed.
Check whether this job fits
Answer these without sending files, logins or personal data. Nothing is submitted unless you choose to contact us.
Checks you can run yourself
Spot-check one app
Export the user list from one app, pick the last three people who left and search for them by email.
Look for: Any leaver who is still listed as active. That is the kind of row this job finds across every app.
What you get
- The leavers-with-access list
- The evidence file for every row
- A not-covered list of apps without an export
- The question list for the owner
Included
- A staff list limited to five fields: name, work email, start date, leave date and manager
- Accounts that are not on the staff list, listed apart as questions for the owner
- Your identity directory and up to 5 apps, each as a user export or a read-only role you create
- Up to 250 people
- A three-way match of the staff list, the directory and each app
- A seeded test on a synthetic set with 10 ex-staff accounts your admin plants
Not included
- Disabling or deleting any account
- Reading mailbox or file contents
- HR data beyond the five staff-list fields
- A decision on who should have access
- Contacting any former employee
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
On a synthetic set your admin builds and keeps from us until the test run (10 ex-staff accounts across 5 apps, 2 accounts not on the staff list, 30 current staff): all 10 ex-staff accounts are found. The 2 accounts not on the staff list are listed apart. No current staff member is listed as a leaver.
Evidence: The planted list beside the leavers list.
Every row in the real list points to a row in an export file that your admin can open.
Evidence: The evidence file and the row references.
Your admin checks 20% of the rows, at least 10, against the live consoles and finds each one correct.
Evidence: Your marked sample and the count of false rows.
No account, role or seat was changed by us, and every app without a usable export is listed as not covered.
Evidence: Your own audit logs and the not-covered list.
Sign-off. Your admin checks the sample and signs off in writing. The 10-account test is a smoke test, not a measured rate. Payment follows sign-off.
If it fails. If a test is not met, you do not pay for this fixed scope. We hand over what we found and agree whether to stop or re-quote; no surprise work.
When it fits, and when we stop
It fits when
- HR will share the five staff-list fields and no more
- Each app can give a user export, or you can create a read-only role and remove it afterwards
- Leave dates are recorded for most leavers
- A named admin can confirm a sample against each live console
We stop and tell you if
- HR will only share more than the five fields, or the staff list includes pay or health data
- Fewer than half of your apps can give a user export
- You suspect an active break-in, which needs incident response first
What could go wrong
This job reads files you send and writes a report. It changes nothing in your systems, so there is nothing to revert. Our copies of your files are deleted when the job ends.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A person is listed as a leaver by mistake and someone removes a current colleague's access. | The test counts any current staff member listed as a failure, and your admin confirms rows before anything is changed. |
| An app without an export is silently skipped. | Every named app is either covered or listed as not covered, with the reason. |
| Names or notes in an export contain instructions meant for a language model. | Export text is treated as data only. The run has no send or change tools, and inputs and outputs are logged. |
| The staff list holds more personal data than needed. | Only five fields are accepted, and a list with more is returned for trimming. |
A separate automated reviewer checks every output against the agreed test before hand-over. No person on our side reviews unless your agreement names one. Your named IT admin approves what is used.
How we deliver
We arrange the work and independent review, then show you the result against the agreed checks. You keep authority over your systems.
- Agree the five staff fields, the apps and how each export is made
- Your admin plants 10 ex-staff accounts in a synthetic set we have not seen
- Match the staff list, directory and each app export by work email
- List leavers with live access, each row pointing to its export row
- Separate automated review of every row against its source
- Hand over the list, evidence files and not-covered apps; delete our copies
This is a one-off job, not emergency cover or a subscription. We confirm eligibility, the total price, a start window and a delivery date before you accept, and an enquiry creates no charge or booking. Work starts only after agreed inputs, secure access and any needed permissions are in place.
Need to keep it working?
Discuss a monthly check that repeats this list.
Ongoing work is separately scoped and quoted: no monitoring, response-time guarantee or automatic subscription is included in this job.
Explore an ongoing managed lane, or mention the responsibility you need in your enquiry.
What you can check
This is a new service. We have not delivered this job for a client yet.
Other ways to get this done
- Run each app's user export yourself and compare it with the staff list in a spreadsheet. It works for one or two apps and gets slow after that.
- Native Microsoft access reviews need an Entra ID Governance subscription, and some capabilities may work with Entra ID P2. learn.microsoft.com
Questions
Will you disable the accounts you find?
No. We list them with evidence. Your admin decides and makes every change.
What HR data do you need?
Five fields only: name, work email, start date, leave date and manager. No pay, health or performance data.
Can it run every month?
Yes, as a separate monthly service that repeats this check on fresh exports.
Send an enquiry
Send us
- The apps you want covered, up to 5, and your directory type
- Roughly how many current staff and leavers there are
- Whether each app can export its user list
Later, once you agree
- The staff list with the five fields only, through an agreed secure route
- A user export from the directory and each app, run by you
- A named admin who confirms a sample against each live console
- The agreement that names the model provider, its country and how long it keeps data, settled before any real personal data is shared
You keep every account and decide what to remove. Where a read-only role is easier than an export, you create it, we use it for the run and you remove it afterwards. Exports can hold display names and notes written by anyone, so we treat their text as data and never follow instructions found in it.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “it-leavers-with-live-access-found-across-accounts-and-apps” as the subject.