Description

Ensure that people who have left the organization, or no longer need access, are removed from the Render workspace as part of the offboarding process. The member list should be reviewed regularly against the company's current staff and contractor list.

Rationale

Former employees who stay in the workspace can still deploy code, read secrets, open shells, and access production data. Even if they mean no harm, their accounts are often no longer monitored and are easier to compromise. Removing them promptly closes this access and keeps the member list accurate.

Impact

  • Former staff can no longer access services, secrets, or data

  • Keeps the member list accurate for audits

  • Removed users lose access immediately

Default Value

Render does not remove members automatically. Without SAML SSO and SCIM (Scale and Enterprise plans), members stay until an Admin removes them.

Pre-Requisites

  • Workspace Admin role

  • A current list of employees and contractors

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Scroll down to the Team members section and compare each member with your current staff and contractor list.

  4. If any member has left the organization or no longer needs access, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. Scroll down to the Team members section.

  4. Open the ••• menu next to the former member and click Remove team member, then confirm.

  5. Rotate any secrets, API keys, or database credentials the person had access to, if required by your policy.

  6. On Scale or Enterprise plans, consider SAML SSO with SCIM so members are removed automatically when they leave your identity provider.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Select your workspace from the workspace dropdown at the top of the left pane, then click Settings in the left pane to open Workspace Settings.

  3. In the Team members section, click + Invite members and invite the user again with the correct role.

Reference