Offboarding
Learn how to revoke access and offboard a user following personnel changes.
Offboarding a user is necessary following personnel changes in your organization. You can revoke their access following the process below.
Revoke Pantheon access
When a person with access to your site(s) on the platform leaves the company or project, it is important to immediately remove them from the team so that they no longer have access to make changes to your site.
The following operations are authenticated via SSH Keys, which are configured by the user in their account dashboard:
- Git
- SFTP
- Terminus (Drush and WP-CLI)
Once a user is removed from a given Pantheon site, their SSH key will no longer authenticate these operations.
All users can be removed except the site owner.
To remove a user:
Go to the workspace and select the Team tab.
Find and select the team member(s) you wish to remove.
Select Actions, then Remove.
Select Yes, I am sure I want to remove this person, then click Yes, Remove.
Enterprise customers with the Administrator role will instead be provided additional options to remove the user's access from associated sites. You will need to select one of the following and then click Remove Access:
Everything: removes the Pantheon user from the workspace and any site teams across all sites associated with the given workspace on Pantheon. This does not impact WordPress and Drupal user accounts, which need to be revoked separately by blocking or deleting the user account inside the CMS.
Workspace Only: removes a member from this workspace only. Associated sites will not be impacted.
To remove a team member from a site:
Go to the Site Dashboard for the site.
Click Team.
Select the 'x' for each team member you wish to remove.
Enterprise customers with the Administrator role will instead be provided additional options to remove the user's access from associated sites and will need to select one of the following:
This site: removes the workspace from this site only.
All sites workspace has access to: removes the workspace from all sites it's currently associated with.
Click Remove Access with one of the selections provided. The team is removed based on the selection you made.
Additional Steps (Recommended)
After a user is removed, in addition to the steps above, we recommend you:
Contact Pantheon support to perform an internal workflow that will migrate your site's database, causing the MySQL credential details to be cycled.
This step is necessary since database credentials are printed in the dashboard and do not depend on a user's site access for authentication. Make a note of your current credentials and compare them afterwards to ensure database access was properly revoked.
Change any shared account passwords the user may have had access to.