Staff offboarding: 12 accesses to revoke when someone leaves

When a receptionist or a manager leaves, their list of accesses is rarely in one place. They had a user in the PMS, the OTA extranets and the bank portal, knew the safe and router passwords, and the hotel's WhatsApp may have run on their phone. The 12 items below are organised by system and type of access.

Before the exit: know who has access to what

When to revoke depends on the type of exit. In a planned exit, access ends when the work ends, at the agreed time. In an immediate dismissal, revocation happens alongside the conversation. If you suspect misuse, containment comes first, through the incident process, even if the conversation hasn't happened yet.

None of this works unless the hotel knows in advance what each person can access. That takes two things. The first is an access matrix by role: which systems the front desk, reservations, finance and housekeeping teams use, and with which profile. The second is named accounts, one per person. A generic account such as "frontdesk1", shared by five people, can't be disabled when one of them leaves; all you can do is change the password and tell the other four.

The 12 accesses to revoke

1. PMS user

Deactivate the user when the person leaves, without deleting it. In many PMS, deleting a user can break the link to who made each posting, discount or refund, and that history is what the hotel checks if a cash discrepancy shows up weeks later. Any later deletion depends on how the system treats audit records and on the retention period the hotel has set. If the person knew the password of a shared profile, such as the night auditor's, change that too.

2. Email

Block the login and end open sessions on phone and browser: changing the password does not always end a session that is already open. Revoke app passwords. Check the automatic forwarding rules, because a forward to a personal account keeps sending booking and vendor emails after the person has left.

Decide who is authorised to open the mailbox, for what and for how long; the line manager is not automatically that person. Before removing the licence or deleting the account, preserve or transfer email, files (OneDrive, Google Drive) and calendars. In Microsoft 365, for example, mailbox content is kept for 30 days after the licence is removed and is then permanently deleted. Hand over pending reservations, vendor contacts and approvals in progress as well.

3. OTA extranets and channel manager

Remove the user from each OTA extranet and from the channel manager. Depending on the profile, extranet access lets someone change rates, availability and payout bank details. If an extranet account sits on the person's personal email, transfer ownership or recovery control to a hotel account before removing the access. Changing the login email alone may not be enough, and a shared login brings back the generic account problem.

4. Bank, acquirer and PSP

Remove the person from online banking, the acquirer portal and the PSP dashboard. Collect physical tokens and remove their phone as an authorised device. If they approved Pix or vendor payments, name another approver and review the payees added or changed in the last few weeks.

5. WhatsApp Business

Separate three questions: who owns the number, which primary phone the account is registered on, and which devices are linked. Disconnecting WhatsApp Web and the computers only ends the linked devices: whoever has the primary phone still has the account.

If the phone belongs to the hotel, collect it. If the SIM is the hotel's but sits in the employee's personal phone, the hotel takes back the number and the phone stays theirs: register the account on a hotel phone and confirm it has left the old one. If the SIM is personal, the number is the employee's and the hotel depends on their cooperation to keep it; prepare a hotel number and tell guests with bookings.

Either way, check two-step verification and the recovery email, agree the transfer of the conversations the hotel needs to keep, and remove the agent from any shared messaging platform. Going forward, the hotel's number belongs on a hotel SIM and a hotel phone.

6. Shared passwords

List the passwords the person knew: staff Wi-Fi, safe, alarm, router admin and the camera recorder. Change the admin passwords first. For staff Wi-Fi, individual credentials are best where the equipment supports them: you just disable the leaver's. With a single password, anyone who knows it can still join the network, even from the pavement, so decide on the change by risk: what the network reaches and how the exit went. Separating the network reduces its reach but doesn't settle the question.

7. Master key card and door lock system

Collecting the card is not enough: cancel it following the manufacturer's procedure so it stops opening doors even if a copy exists. With offline locks, a cancellation made in the software may not reach the door by itself, and this varies by system: you may have to update lock by lock. Confirm the cancellation reached all of them and record that it is done. Removing the person's user from the lock software is a separate task, and both need doing.

8. Remote access, VPN and MFA

Disable the VPN account and the remote access tools installed on the hotel's computers. Look for admin accounts whose second factor (MFA) is on the employee's phone: the admin email, the firewall, the domain dashboard. If the second factor depends on the phone of someone who left, the hotel can lose access to its own account. Add the hotel's methods and remove the person's: recovery email and phone, authenticators, passkeys, backup codes, password manager and API credentials. Also look for integrations and scheduled tasks that run under their account and move them to a service account; in a planned exit, do this beforehand so a hotel process doesn't stop.

9. Social media, Google business profile and website

Before removing the person as an admin, confirm there is another admin authorised by the hotel on each account. If they were the only one, ask for the transfer during the exit conversation. Recovering an account with no admin can take weeks.

10. POS, time clock, ERP and accounting

Disable the user in the restaurant and bar POS, the ERP and the accountant's portal. In the time clock and HR system, remove operational access, such as approving or adjusting records. If the former employee still needs payslips or employment documents, HR sets up that access separately, limited to their own documents. Change supervisor passwords they knew, such as the ones that authorise POS discounts and voids.

11. Equipment and personal phones

Collect the laptop, company phone, tokens and badge, and record what came back and what is still outstanding. On a personal phone, follow the rule agreed with the employee: selective removal through MDM, if it was already set up on the phone, or removing the hotel email and apps together with the person. Record whether the removal completed. It doesn't delete downloaded files, exports or screenshots.

12. Record, vendors and accounts in the person's name

Write down each access revoked, who revoked it, and the date and time. Tell the vendors that had the person as an authorised contact: the PMS vendor, for example, acts on requests from whoever is on its list. And look for domains, cloud accounts and subscriptions registered to the person's CPF (Brazilian taxpayer ID) or personal email, whose ownership or administration needs to be transferred to the hotel. One person owns the close-out: they check each item was done and close the list.

Who does each part

In a hotel without in-house IT, revocation is split between departments. Agree beforehand who does what and who closes the list. HR tells this group in advance, in confidence, with the time set.

Contentious exits and dismissal for cause

In an exit with conflict, revoke access during the termination conversation, not after it. Agree the time with HR and prepare revocation of the accesses that can do the most damage: email, bank, extranets, remote access. If you suspect the person copied data or changed records, block access promptly and preserve the logs: don't delete accounts or wipe devices before assessing what evidence the hotel needs to keep. Talk to the hotel's lawyer. If guests' personal data was copied and the incident may cause relevant risk or harm to them, it has to be reported to the ANPD (Brazil's data protection authority) and to the people affected, within the deadline. See what to do in the first 48 hours of a breach.

Temporary and seasonal staff

In high season the hotel hires extra staff for a few weeks, and theirs are the accesses that get forgotten most. Create temporary accounts with an expiry date where the system allows it, and put revocation in the checklist for the last day of the contract. A regular access review helps find accesses that stayed active.

Next steps

HotelTI's IT management reviews who has access to what, documents the access matrix and the offboarding checklist, and sets the administration standards that the hotel's vendors apply. Support is during business hours. We do not resell software or have agreements with specific vendors. Talk to our team.

Sources

• ANPD, Resolution CD/ANPD 15, Security Incident Reporting Regulation (April 2024), in.gov.br
• PCI Security Standards Council, PCI DSS v4.0.1, requirement 8.2.5 (access for terminated users revoked immediately), pcisecuritystandards.org
• Center for Internet Security, CIS Controls Assessment Specification, safeguard 6.2 (disabling accounts immediately on termination and preserving audit trails), readthedocs.io
• Microsoft, Remove a former employee (order of blocking, preserving data, removing the licence and deleting the account), learn.microsoft.com
• WhatsApp, About linked devices (primary phone and linked devices), faq.whatsapp.com