Orphaned Accounts: The Audit Finding Hiding Between HR and IT
Active accounts that belong to people who've left are one of the most common findings in security audits. Here's why they happen and how syncing UKG with Active Directory prevents them.
An orphaned account is a user account that no longer belongs to an active employee. The person has left, but the account is still enabled, still in its groups and often still holding a license.
Orphaned accounts are a familiar finding in SOX, SOC 2 and internal access reviews. They’re also one of the easiest to prevent.
How orphaned accounts happen
A termination is processed in UKG but never reaches IT
The account is disabled but left in its security groups
A contractor’s assignment ends without a formal termination
An employee transfers between companies and the old account isn’t cleaned up
Access is reviewed once a year, so problems sit for months
In almost every case the root cause is the same: the system that knows the person left (UKG) isn’t connected to the system that controls access (Active Directory or Entra ID).
Why access reviews alone aren’t enough
Periodic access reviews matter, but they find problems after the fact. If your review runs quarterly, an orphaned account can exist for up to three months before anyone spots it. Reviews also take a lot of time from managers who are asked to confirm long lists of names.
Prevention is cheaper than detection. When terminations in UKG disable accounts automatically, your access review becomes a confirmation exercise instead of a cleanup project.
How to prevent them
Make UKG the trigger for every termination. When the employee status changes, the account is disabled on the next sync.
Remove group access, not just sign-in. User Deprovisioning removes security and license groups and moves the account to your disabled users OU.
Keep job changes in sync. When someone moves roles, Group Mapping removes access they no longer need. That prevents privilege creep, which auditors look for too.
Notify the right people. Send termination details to IT, security or a ticketing address so there’s a record.
Keep the logs. Every sync is logged, so you can show exactly when access was removed.
What to show your auditor
Auditors want evidence, not promises. With an automated sync you can point to the rule that disables accounts, the log showing when each termination was processed and the notification that went to your team. That’s a much easier conversation than rebuilding events from old tickets.
It also helps when your vendor can show its own controls. Connect to AD is SOC 2 Type 2 verified, with an independent auditor testing our controls over a full 12-month period. Reports are available on our Security page.
Close the gap
Orphaned accounts are a symptom of a disconnected process. Connect UKG and your directory, and the problem largely goes away. Book a demo to see how terminations flow from UKG to Active Directory, or start your free trial.
