Holiday Temps Leaving? Revoke Their AI Access Fast

The holiday rush is winding down, and the extra hands you hired for it are heading out. That part's easy. The hard part is everything they logged into while they were here: your shared ChatGPT or Claude workspace, the scheduling app, the POS, Google Drive, maybe an API key someone pasted into a spreadsheet so the AI chatbot on your site would keep working.

Most small businesses in Burnaby and across Metro Vancouver don't have an IT department. Offboarding a seasonal worker usually means taking back a key and saying thanks. But with AI tools now holding customer emails, quotes and booking notes, a forgotten login is a real gap. Here's how to close it quickly, based on what the vendors themselves document.

Why AI accounts deserve special attention

A temp with an old login to your AI workspace isn't just a seat you're paying for. Depending on how your team used it, that workspace can hold pasted customer details, draft contracts, pricing and internal notes.

In BC, the Personal Information Protection Act, section 34 says an organization "must protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access." Federally, the Office of the Privacy Commissioner's PIPEDA Safeguards principle lists "limiting access" among the organizational safeguards and recommends limiting employee access to a "need-to-know" basis. Someone who left in December doesn't need to know anything in January.

Neither law hands you a checklist of specific tools. The OPC page is explicit that you're expected to keep your protections current as technology changes. So the bar is "reasonable," and leaving a former temp with live access to customer data is hard to defend as reasonable.

Start with your identity provider, but don't stop there

If your staff sign in with Microsoft 365 or Google Workspace accounts, that's your first switch. It's also where a lot of owners assume the job is done. It isn't.

Microsoft 365. Microsoft's guide to revoking user access in Microsoft Entra ID (updated June 2026) walks through two steps in the admin center: clear "Account enabled" on the user, then select "Revoke sessions." The same page is candid about the lag. By default, access tokens issued by Entra ID last for one hour, and apps using them keep working until the token expires. Worse, apps that issue their own session cookies control access themselves, and Microsoft states plainly that Entra ID "can't directly revoke a session token issued by an application." That's why Microsoft recommends automated deprovisioning, and notes its app provisioning service typically runs every 20 to 40 minutes.

Google Workspace. Google's help page on how to sign a user out of a managed Google Account lets an admin reset a user's sign-in cookies to sign them out of browsers and mobile devices. It also warns that this "does not sign them out of apps, such as Gmail and Google Drive for desktop." So suspending the account matters, and you should still check desktop apps on any shared machine.

The lesson from both: disabling the main account blocks new sign-ins, but existing sessions in third-party apps can outlive it. You have to visit the AI tools directly.

Removing people from AI workspaces

The big AI assistants do have proper admin controls on their business plans. Use them.

Claude (Anthropic). Anthropic's support article on managing members on Team and Enterprise plans says to go to Organization settings, then Members, open the menu beside the person and choose "Remove from team." Per that page, as of October 2026, removed members "lose access to the organization immediately," their seat becomes free to reassign, and if you re-add the same email later their history is kept. One catch worth knowing: removing someone "does not automatically reduce your plan's total seat count," so you may still be billed for the empty seat. Enterprise organizations using SCIM get automatic removal when the person is removed from the identity provider.

OpenAI API keys. If a temp ever had a login to your OpenAI developer account, say to tweak a chatbot or test a booking assistant, check that too. OpenAI's production best practices guide tells you to keep API keys out of code and public repositories, store them securely, and rotate them on a schedule. It also describes organization roles (Readers can make API requests; Owners can also manage billing and members) and says admins can restrict which kinds of keys may be created. Remove the departing member, then look at which keys exist and who created them.

ChatGPT workspaces have their own member removal setting too. We couldn't load OpenAI's help article on it while writing this, so check the current admin docs in your workspace rather than taking our word for the details.

A 30 minute offboarding checklist

Here's a practical order of operations for the day a temp leaves. Do it the same day, not "after the holidays."

• Disable the main account in Microsoft 365 or Google Workspace, then revoke sessions or reset sign-in cookies.
• Remove them from every AI workspace (Claude, ChatGPT, Copilot, Gemini, whatever you use) through the admin console, not by changing a shared password.
• Rotate any API key they could have seen, especially keys stored in shared docs, chat threads or a no-code automation tool.
• Check connected apps. Scheduling, POS, CRM and social media accounts often have separate logins that your main account doesn't control.
• Transfer ownership of files, chats or custom assistants they built so nothing breaks when the account goes.
• Sign out shared devices and close desktop apps on the shop computer or tablet.
• Write it down. A one page log of what was removed and when is your evidence that you made "reasonable security arrangements."

For a business with five to ten temps, the list above is realistic to run by hand. Past that, it's worth automating.

Where automation helps, and where it doesn't

Automated deprovisioning is what Microsoft itself recommends, and SCIM support on enterprise AI plans means removing someone once can cascade to several apps. For a growing shop, a small workflow that fires when HR marks someone as finished can save a lot of missed steps.

But be honest about the limits:

• SCIM and SSO usually sit on higher tier plans. Per Anthropic's own article, automatic SCIM removal is described for Enterprise organizations. A five person team on a basic plan may not have it, and upgrading just for offboarding rarely makes sense.
• Sync isn't instant. Microsoft's own numbers (one hour default token life, 20 to 40 minute provisioning cycles) mean automation can still leave a window. For a hostile departure, do the manual steps right away.
• Shared logins break everything. If three temps used one "frontdesk@" account in your AI tool, no automation can remove one of them. The fix is individual seats, which costs more.
• Offline devices keep local data. Microsoft notes a remote wipe only triggers when the device is connected to the internet. A laptop that never comes back online keeps whatever was downloaded.
• Some seasonal setups don't need AI accounts at all. If a temp only answers phones and stocks shelves, the safest login is the one you never created.

Where this doesn't apply

If your temps never touched an AI tool or a cloud app, this is mostly a key and alarm code exercise. If you're in a regulated field like healthcare or law, your obligations go beyond PIPA and PIPEDA, so talk to your privacy or legal adviser rather than relying on a blog checklist. And nothing here replaces the vendor's current admin documentation, since menus and plan features change often.

The bottom line

Holiday temps are a normal part of retail and hospitality in New Westminster and Burnaby. Their AI access should end on the same day their shift does. Disable the main account, remove them inside each AI tool, rotate keys, and keep a short record. It takes half an hour and closes a gap most small businesses never notice.

Sources

• Government of British Columbia, Personal Information Protection Act [SBC 2003] c. 63, section 34. bclaws.gov.bc.ca
• Office of the Privacy Commissioner of Canada, PIPEDA Fair Information Principle 7: Safeguards. priv.gc.ca
• Microsoft Learn, Revoke user access in an emergency in Microsoft Entra ID, updated June 2026. learn.microsoft.com
• Google Workspace Admin Help, Sign a user out of a managed Google Account, accessed October 2026. knowledge.workspace.google.com
• Anthropic, Claude Help Center, Manage members on Team and Enterprise plans, accessed October 2026. support.claude.com
• OpenAI, Production best practices, API documentation, accessed October 2026. developers.openai.com

Not sure which of your tools still have a former temp logged in? Book a free call with Autana. We'll walk through your AI and app stack with you and map out a simple offboarding routine that fits a small team.