---
path: onboarding/manager-onboarding/audit-and-offboarding.mdx
title: Audit and offboarding
sidebar_position: 6
slug: audit-and-offboarding
pagination_next: null
pagination_prev: null
description: >-
  How to audit vault and password change history in Passwork, and how to handle
  employee offboarding: blocking access, auditing exposed credentials, and rotating passwords.
keywords:
  - Passwork
  - audit
  - offboarding
  - change history
  - activity log
  - block user
  - password rotation
  - employee departure
  - security
---

## View vault and password history

Passwork records all changes made to passwords and vaults. Use the history to investigate unauthorized edits, check when a credential was last changed, or confirm who performed a specific action.

### Vault history

1. Open the vault in the navigation pane.
2. Click **Vault settings** (three-dot menu next to the vault name).
3. Select **History**.

<ImageComponent
  src="/img/assets/vault-history-1.png"
  alt="Vault history view"
  format="regular"
/>

The history shows the full change log for the vault, including password additions, edits, deletions, and access changes, with timestamps and the user who performed each action.

### Activity log

The **Activity log** accessible with a corresponding role setting provides a system-wide audit trail. As a manager, use it to monitor activity within your department's vaults.

<ImageComponent
  src="/img/assets/activity-log-1.png"
  alt="Activity log in Passwork settings"
  format="regular"
/>

For full activity log documentation, see [Activity log](https://passwork.pro/user-guides/settings/activity-log/).

## Employee offboarding checklist

When a team member leaves the organization or changes roles, follow this checklist to prevent unauthorized access to corporate credentials.

|  | Action | How |
|---|--------|-----|
| 1 | **Block the user in Passwork** | Settings → Users → select user → Block. Do this before or simultaneously with revoking other system access. |
| 2 | **Remove the user from all shared vaults and folders** | Open user's page and set 'Forbidden' level for all vaults they have access to. |
| 3 | **Identify all credentials the user had access to** | Use Security dashboard to find records user had access to. |
| 4 | **Rotate all passwords the user had access to** | Change every credential the departing user could read, regardless of whether misuse is suspected. |
| 5 | **Revoke any active shareable links they created** | Open the Additional access dashboard for each vault and revoke links created by that user. |
| 6 | **Transfer ownership of any vaults they owned** | Reassign vault ownership to another manager or administrator before the account is deleted. |
| 7 | **Delete the user account** (optional) | After completing all steps above, delete the account from Settings → Users. Retain the account if audit records must be preserved. |

<ImageComponent
  src="/img/assets/block-user.png"
  alt="Block user action in user settings"
  format="regular"
/>

:::warning Rotate credentials promptly
Credential rotation is the most critical step. A blocked user can no longer log in to Passwork, but credentials they memorized or copied before being blocked remain valid until changed. Prioritize rotating privileged accounts (admin credentials, production systems, payment processors).
:::

---

You have completed the Manager onboarding. Your department vault is set up, your team has appropriate access, you know how to share credentials safely, and you have a checklist for handling access during staff changes. If you need to configure LDAP synchronization, custom roles, or system-wide policies, refer to the [Admin rollout playbook](../admin-onboarding/intro.mdx).