How can we help?

User access should be reviewed whenever an employee joins the organization, changes responsibilities, moves between departments, or leaves the company. Maintaining accurate access assignments helps protect business information and ensures that employees have permissions appropriate to their current responsibilities. When should access be updated? Common situations include: 1. An employee receives a new responsibility. 2. A team member moves to another department. 3. A manager changes role. 4. An administrator no longer requires elevated privileges. 5. A temporary assignment ends. 6. An employee leaves the organization. 7. A workspace is reorganized. 8. A security review identifies unnecessary access. 9. An external contractor's engagement ends. 10. An account is suspected of unauthorized use. How to review an employee's access Step 1: Identify the employee. Step 2: Confirm the relevant workspace. Step 3: Review their current role. Step 4: Identify the permissions required for their current responsibilities. Step 5: Determine which access should be retained, modified, or revoked. Step 6: Use the available team management functionality to apply supported changes. Step 7: Verify the resulting authorization. Step 8: Review any operational dependencies associated with the employee. What should happen when an employee changes departments? The organization should review whether the employee still requires access to their previous operational environment. Access that is no longer necessary should be removed where supported. New permissions should be assigned according to the employee's updated responsibilities. What should happen when an employee leaves? An authorized administrator should promptly review and revoke access through the applicable account and workspace management processes. The organization should also consider: 1. Active sessions. 2. External accounts and integrations. 3. Business processes associated with the employee. 4. Administrative responsibilities requiring reassignment. 5. Any organization-specific security procedures. Does removing a user automatically disconnect every external account they previously authorized? Not necessarily. External integrations may have independent authorization arrangements. Administrators should review affected integrations separately. Does removing access delete historical business records? Access revocation and data deletion are different operations. Historical records should not be assumed to disappear merely because a user's permissions change. What if access cannot be changed through the available interface? Contact the appropriate Enterprise administrator or Polyosync Support. Do not attempt to bypass permission controls. Recommended approach Treat access management as an ongoing administrative responsibility. Review permissions whenever personnel or organizational responsibilities change, rather than waiting for a security incident.