Short answer: If the person had a copy of a 2FA secret, on their phone, in a screenshot, or in a password manager they could read, reset 2FA on that account so their copy stops working. If they only ever received codes from a shared vault, removing them from the vault is enough. Either way, change any shared password they knew and check the account's backup codes and recovery details.
Offboarding checklists usually cover laptops, email and the password manager. 2FA gets missed, because nobody wrote down where the codes live. And if a 2FA secret walked out the door on someone's phone, it keeps working until you reset it.
Here's the 2FA part of offboarding, step by step. It's not about distrust. Most people leave on good terms, but even a friendly ex-colleague's lost phone is your problem if it still makes codes for your accounts.
Step 1: Work out where their 2FA lived
What you need to do depends on where the 2FA secret was stored. Find your situation:
| Where the 2FA secret was | Did they have a copy? | What to do |
|---|---|---|
| Their own phone (Google Authenticator, Microsoft Authenticator, Authy) | Yes | Reset 2FA on every account |
| A shared phone they could unlock | Possibly. Any authenticator export, screenshot or backup is a copy | Reset 2FA unless you're certain |
| A screenshot or setup key sent in chat or email | Yes, and so does anyone who can read that thread | Reset 2FA and delete the messages |
| A password manager item they could edit | Usually yes, because editors can see the setup key | Reset 2FA |
| A shared 2FA vault that only sends codes | No | Remove them from the vault |
| SMS to their phone number | The code goes to their phone | Change the phone number on the account |
If in doubt, assume they had a copy. Resetting 2FA takes a minute per account. Being wrong takes much longer to fix.
Step 2: Make the list of accounts
You can't reset what you don't know about. Build a list of every account where the person could get a 2FA code:
- If you use a shared vault with an audit log, look through it for that person. In Fox Auth, the audit log shows every code they revealed, copied or autofilled, and when, for your plan's retention period.
- If codes lived on phones, ask the person before their last day to open their authenticator app and go through the work accounts with you. It's the only way to see what's there.
- Check your password manager for shared items that include a 2FA code.
- Search chat and email for words like "QR", "2FA", "authenticator" and "backup codes". Setup screenshots turn up more often than you'd think.
Step 3: Cut off access
Do this first, before the resets, so nothing changes under you while you work:
- Remove them from your shared vault. In Fox Auth, an owner or admin removes them in Members. They lose every shared code straight away, and their Only me codes are deleted.
- Disable their own logins on each platform where they had separate access (Google Workspace, Microsoft 365, ad platforms, cloud consoles).
- Change shared passwords they knew. A 2FA vault keeps codes, not passwords. If they knew the password to a shared account, change it in your password manager.
Step 4: Reset 2FA where they had a copy
For each account where they held a copy of the secret:
- Sign in with the current code.
- Open the account's security or two-step verification settings.
- Remove the authenticator app, then set it up again. Some sites call this "change authenticator app" or "reset 2FA".
- Scan the new QR code into your shared vault. Every old copy stops working at this point.
- Check the new code works before you close the settings page.
If you're using a shared vault from now on, this is the last time you'll need to do it for these accounts. Next time someone leaves, removing them from the vault is enough.
Step 5: Replace backup codes and recovery details
2FA has back doors on purpose, and they need offboarding too:
- Backup codes: generate a new set on each account. The old set stops working. Store the new codes with the account owner, not in the shared vault.
- Recovery email and phone: if the person's personal email or mobile number is listed as a recovery option, replace it with a role address or the owner's details.
- SMS 2FA: if codes went to their number, change it now. Better still, switch the account to an authenticator app so it can live in your vault.
- Account ownership: if they created accounts with their own work email, move ownership to a role address (for example, ads@yourcompany.com) before you shut their mailbox.
Step 6: Sign them out everywhere
A reset 2FA secret doesn't end sessions that are already signed in. On the platforms that support it, end other sessions or sign out of all devices. Then check connected apps and API keys they created.
Step 7: Write it down
Record what you changed and when. If you're working towards SOC 2 or ISO 27001, removing access promptly with evidence is exactly what auditors ask about (see what compliance frameworks expect). Your Fox Auth audit log already records the member removal. Add a note for the resets you did on each platform.
Make the next one take two minutes
Offboarding hurts when 2FA secrets are spread across phones, chats and screenshots. Fix it once:
- Keep shared 2FA in one vault that sends codes, not keys. Removing a person is then one click, with nothing to reset.
- Keep personal accounts separate. In Fox Auth, personal codes stay Only me, so they don't get mixed in with the team's.
- Use separate logins wherever the platform allows, so you disable a user instead of resetting a shared account.
Moving to a vault is quickest right after an offboarding, while the new QR codes are on your screen anyway. If your team currently uses Google Authenticator, you can bring the codes across in about ten minutes. And if you're working out how your team should share 2FA from now on, start with our guide to sharing 2FA with your team.
Frequently asked questions
If I change the password, do I still need to reset 2FA?
Yes, if they had a copy of the 2FA secret. Changing the password stops them signing in today. But if your password leaks later, their copy of the 2FA secret still produces valid codes. Reset both.
How do I reset 2FA on an account?
On most sites, open the security settings, remove the authenticator app, then add it again. That creates a new secret key and a new QR code, and every old copy stops working. Some sites have a "change authenticator" option that does both in one step.
How do I find out which 2FA codes a person used?
If the codes lived on phones, you can't, so you have to assume they had all of them. In Fox Auth, the audit log lists every code each person revealed, copied or autofilled, with their name and the time, for your plan's retention period.
What if their phone number is on an account for SMS 2FA?
Change it straight away. Codes will keep going to their phone until you do, and if they lose that number, so does your recovery path. Better still, switch the account to an authenticator app.
