The subscription ends. What else remains?
A small business replaces its appointment tool. The new system works, the old subscription is canceled, and the project feels finished. But someone connected the old tool to a calendar, a shared mailbox, and an automation service months earlier. Who checked those connections?
Changing tools is a security event as well as an operational one. The important question is whether the old service can still reach business information or act through another system. A billing confirmation does not answer that question. Neither does removing a shortcut from a staff laptop.
Follow the connections from both ends
Start with the job the old tool performed. List the accounts it used, the information it received, and the systems it connected to. Ask the person who set it up, then check the actual account settings. Memory is useful for finding a connection; settings help establish what permission exists now.
Look from both directions. The retired application may show a calendar integration, while the calendar provider lists that application among services granted access. An automation service may sit between them. Document the account that owns each connection and the business process that depends on it.
For each connection, write down whether it reads information, changes it, or takes an action. A connection used to copy appointment details has a different consequence from one allowed to send messages or change records. The business needs that distinction before deciding what should remain.
Include AI assistants in the connection map even when they appear to be only a feature of another service. An assistant may have received uploaded documents, delegated access or permission to take actions. During the handover, identify which of those arrangements belongs to the retired tool and which continues independently. A new assistant should receive its own deliberate access decision.
A sign-in link and data access are different
Google’s account guidance distinguishes using Google to sign in from allowing another application to access Google Account data. Removing a sign-in link stops that sign-in arrangement; it does not delete information already held by the application. Review the relevant data-access connection as well.
Microsoft also provides an application-permission review process through Microsoft Entra. Its documentation distinguishes permissions granted for an organization from those granted for individual users. The person responsible for the business environment should review the applicable permissions rather than assuming one employee’s settings show the whole picture.
The practical lesson is to check what each control actually does. Signing out, disconnecting an integration, revoking a permission, canceling a subscription, and requesting deletion of retained information are different actions. A handover should account for the ones relevant to that service.
Check what would break before removing access
A forgotten connection may still support a useful process. Perhaps a daily export feeds an accounting task or the old booking form remains linked from an email template. Ask the process owner before making the change. Identify the replacement and confirm that the business can complete the task without the old connection.
Then have an authorized account owner remove the access that is no longer needed, following the provider’s instructions. Record what changed and confirm the intended result in the relevant settings. Keep a clear distinction between access that was removed and access still needed for a specific, documented purpose.
For an AI-assisted workflow, test the replacement with harmless sample information and have a person check the proposed output or action. A summary that looks plausible does not prove that the right source was used. Confirm the replacement reads the intended material and retains the business’s approval step before removing the old dependency.
Give retained information its own question
Removing access addresses a connection. It does not establish what information a provider already holds, how long it keeps it, or which exports staff saved elsewhere. Check the service’s account controls, retention terms, and available deletion process. Preserve the business records the organization needs before closing an account.
Apply the same review when replacing an AI tool. Ask which documents or conversations were provided, which business services were connected, and which actions the tool could perform. The presence of an AI feature does not remove the need to identify the account owner and the permissions involved.
Make access part of the handover
Add an access review to the moment a business changes an application, supplier, or responsible employee. Record the old service, its owner, its connections, the replacement process, and what happened to retained information. Leave an identified person responsible for any unresolved item.
The goal is a complete change, not simply a new tool. When someone asks what the retired service can still reach, the answer should come from a checked record of the handover rather than a guess.