What to Do If a Terminated Contractor Still Has Access to Your Shared Mailbox for Referrals
Ready to simplify HIPAA compliance?
Join thousands of organizations that trust Accountable to manage their compliance needs.
Immediate Access Revocation
Act in the first 10 minutes
- Block the account’s ability to authenticate using a Microsoft 365 sign-in block. This immediately prevents new sessions while you complete the rest of the steps.
- Revoke refresh tokens and force sign-out across all devices to cut off existing sessions.
- Remove the user from any groups that grant access to the shared mailbox (mail-enabled security groups, Microsoft 365 Groups, distribution lists).
- Strip delegated permissions on the mailbox (Full Access, Send As, Send on Behalf) to stop reading or sending from the address.
- Disable external forwarding and scan for malicious inbox rules (auto-forward, delete-on-receipt, or redirect).
- Wipe or quarantine registered mobile mail clients where corporate policy allows, and disconnect old device partnerships.
Exchange PowerShell examples (remove access quickly)
# Remove Full Access
Remove-MailboxPermission -Identity "Referrals@contoso.com" -User "terminated.user@contoso.com" -AccessRights FullAccess -Confirm:$falseTable of Contents
Ready to simplify HIPAA compliance?
Join thousands of organizations that trust Accountable to manage their compliance needs.
