Microsoft’s documented Lifecycle Workflows example shows Enable user account still in progress while two other tasks are complete. This older Azure interface does not prove the employee is ready; check task results and test access to each required accounting application separately.[2]
A seasonal preparer is ready when they can open the assigned test client, use the approved document exchange and complete a draft for review, while unrelated clients and release permissions remain unavailable. Use this guide to turn a start-date request into that observable result. The worked readiness record below separates manager decisions from the technical checks.
Agree on the person, supervisor, duties, clients, equipment, start date and access cutoff before provisioning. Keep employment documents in the HR record and send IT only the information needed to implement the decision. Prepare handoffs ahead of departure, but do not postpone an approved access cutoff to finish a file transfer.
What a dependable CPA and financial firm employee access setup should accomplish
A dependable employee workflow prepares the right access before the start date, proves the worker can complete approved tasks, keeps client and financial authority limited, adjusts access when duties change, maintains coverage during leave, and closes every path promptly at departure or seasonal end.
- Every worker has a role, supervisor, employment or contract status, start date, review or end date, assigned services and clients, and approved location.
- Named accounts, MFA, managed devices, secure communication, client groups, application roles, and financial authority are prepared from an approved request.
- Security, privacy, portal, phishing, financial-change, incident-reporting, remote-work, and AI-use training is completed and tested.
- Seasonal expiration, leave coverage, role changes, departures, client handoff, record preservation, and device return have accountable checklists.
- Managers verify readiness after the worker completes representative tasks, not only after accounts are created.
Define role, supervision, client assignments, and access expiration
1. Create an approved role and worker record
Describe the work the person will perform rather than copying another user’s access. Identify permanent, seasonal, temporary, intern, contractor, remote, or transferred status and who can approve client assignment, financial authority, system changes, and exceptions.
Where to work: HR or manager request, employment or contract record, supervisor, service team, duties, location, start date, review or end date, confidentiality requirements, and equipment decision
Verification: HR, manager, and IT agree on identity, start and end dates, duties, supervisor, systems, clients, location, device, and approval boundaries before access is provisioned.
2. Assign named identity, MFA, recovery, and groups
Assign one named identity to the actual person, require the firm’s approved MFA and recovery, and start from an approved role. Do not recycle an account between people. A returning worker’s own account needs a fresh role, client and recovery review before reactivation; separate administrative identities from routine work.
Where to work: Identity provider, email, collaboration, password manager, client portal, tax and accounting applications, payroll, document systems, VPN or remote access, and support
Verification: The worker completes sign-in and recovery testing, cannot enter administrative settings, and receives only the approved base role and time-limited exceptions.
3. Assign services, clients, and restricted records
Grant access from current client and engagement assignments, role, and supervision. Define restricted clients and high-sensitivity data. Keep prospective clients, inactive clients, payroll, assurance, advisory, and other service groups separate when the work requires it.
Where to work: Client roster, engagement assignments, portal, workpapers, tax software, accounting and payroll systems, document storage, email groups, collaboration spaces, and archives
Verification: Test approved, unrelated, restricted, and inactive clients. The worker can perform assigned work and cannot discover other records through search, shared links, inherited groups, or exports.
Prepare identity, applications, financial authority, devices, and training
1. Limit financial and filing authority
Separate preparation, review, approval, transmission, release, reconciliation, and administration according to firm policy. Give seasonal and temporary workers only the authority needed. Require independent verification for bank, payroll, payment, and other high-impact changes.
Where to work: Tax transmission, e-file roles, payroll release, bank and payment connections, invoice approval, refunds, write-offs, reporting, vendor changes, and platform administration
Verification: A controlled test confirms the worker can prepare assigned work but cannot bypass review, transmit unapproved filings, release funds, change bank details, or expand access.
2. Issue a managed device and approved work environment
Assign an inventoried device, enroll it before use, protect and encrypt it, remove unnecessary local administration, install approved applications, and test remote support. Explain restrictions on personal devices, local downloads, printing, removable media, household access, public networks, and disposal.
Where to work: Procurement, inventory, device management, encryption, endpoint protection, patching, local privilege, browser, remote access, home network, printing, physical privacy, and support
Verification: The worker completes representative office and remote tasks on the managed device without personal email, consumer storage, shared computers, unknown extensions, or disabled security.
3. Configure secure communication and client exchange
Teach which information can use ordinary communication and which must move through the approved secure path. Show recipient verification, public-link restrictions, notification handling, safe scanner destinations, and the process for clients who cannot use the normal portal.
Where to work: Email, secure portal, file requests, messaging, phone, voicemail, e-signature, scanner workflow, notifications, and client instructions
Verification: The worker sends a normal message and exchanges a sensitive test document without exposing client data in a public link, wrong recipient, personal account, or analytics system.
4. Complete role-specific security and fraud training
Use scenarios from the worker’s duties instead of a generic annual video. Include suspicious tax notices, client credential requests, urgent executive messages, bank changes, payroll edits, document macros, portal invitations, lost devices, and prohibited handling of client data in unapproved AI tools.
Use the employee-access and training sections of IRS Publication 4557 as inputs to the firm’s written security program, then choose exercises appropriate to the person’s work. A completed course or sample checklist is not proof that the employee can follow the firm’s actual secure process. [1]
Where to work: Learning system, written plan, acceptable use, phishing reporting, tax scams, client impersonation, payment and payroll changes, password manager, remote work, AI tools, incident reporting, and support
Verification: The worker correctly reports and explains the approved response to representative phishing, financial-change, client-data, remote-work, and AI-use scenarios.
Manage seasonal work, role changes, leave coverage, and departures
1. Plan seasonal ramp-up and automatic expiration
Prepare accounts and devices in controlled waves, release client access from approved assignments, and name the operator responsible for each seasonal cutoff. If the firm uses Microsoft Entra Lifecycle Workflows, check the product entitlement, required attributes, selected tasks, scope and schedule, then inspect a test run and its task results. A populated hire or end date alone does not provision or remove access in every application. [2]
Where to work: Seasonal roster, forecast, license inventory, device pool, training schedule, client assignment, start waves, support coverage, access expiration, extension approval, and return logistics
Verification: A labeled test worker completes the approved first-day tasks. At the test cutoff, each covered access path is denied or has an explicitly unresolved action with an owner; do not mark the seasonal-closeout check passed while required revocation remains outstanding. Only a documented extension authorizes continued access.
2. Manage role changes, leave, and client-work coverage
Treat promotion, service transfer, remote-work change, leave, and temporary coverage as access changes. Remove old duties, add approved new access, transfer active client work and deadlines, avoid mailbox password sharing, and schedule review when temporary coverage ends.
Where to work: Transfer request, supervisor approval, client and deadline list, groups, applications, devices, delegated access, shared work queues, temporary coverage, and return review
Verification: A colleague can continue priority client work through approved delegation while the absent or transferred worker cannot retain obsolete access.
3. Run a coordinated departure and seasonal closeout
Prepare client and deadline handoffs before a planned cutoff where possible, and enforce the approved cutoff even if transfer work is unfinished. Microsoft documents that blocking identity access and revoking refresh tokens can leave application-issued sessions to be handled by the application; check the firm’s tax, payroll, portal and remote-access paths individually. [3] Keep preservation, delegated access, license removal and account deletion as separate decisions so the responsible team can retain required work without leaving the former employee signed in. [4]
Where to work: Departure notice, risk decision, active clients, deadlines, approvals, email, files, workpapers, portal, applications, devices, tokens, sessions, recovery, vendors, and records
Verification: The departing worker cannot access firm information, responsible colleagues can continue every assigned client and deadline, required records remain available, and returned devices are accounted for.
Test worker readiness and client continuity
Pilot onboarding with a permanent professional, seasonal preparer, reviewer, remote worker, payroll or billing user, and temporary worker where used. Test approved and restricted clients, portal use, financial authority, phishing reporting, remote work, support, leave coverage, expiration, and departure. Readiness means the worker can complete assigned work and cannot enter unapproved data or authority.
- Role-based access: Use test accounts for preparer, reviewer, payroll, billing, seasonal, and administrator duties. Pass: Each account completes assigned work and cannot cross service, client, or financial authority boundaries.
- Secure client exchange: Have a new worker request, receive, review, and return a sensitive test document. Pass: The approved portal and communication process work without personal or public sharing.
- Fraud and phishing: Send representative client impersonation, tax notice, password, and bank-change simulations. Pass: The worker reports the attempt and follows independent verification and escalation.
- Seasonal expiration: Advance a test worker past the approved end date and then process a documented extension. Pass: Access closes or appears for immediate action, and only approved extensions restore the required role.
- Leave coverage: Remove an employee from availability during active client deadlines. Pass: A named backup receives approved work, deadlines, and records without password sharing or excessive permanent access.
- Departure: Run a full departure using a test identity, assigned clients, device, application tokens, and remote sessions. Pass: Work and records transfer, every access path closes, the device is controlled, and recovery remains available.
Sign off one seasonal preparer using a worked readiness record
This is a proposed test record with fictional clients and no real taxpayer information. It is not an ALLMSP deployment result. Record the responsible person and actual evidence for each row before marking the worker ready.
| Readiness gate | Responsible decision | Evidence needed to pass |
|---|---|---|
| Role and dates | Manager approves preparer duties, assigned test client and a cutoff. | The roster and provisioning request agree; no unresolved owner or extension decision is hidden. |
| Client boundary | Engagement owner approves test client A; unrelated test client B is excluded. | The authorized role test opens A and fails to open or discover B through the tested paths. |
| Financial authority | Service owner permits a draft but reserves transmission and release. | The training task saves a draft and cannot perform the unapproved release step. |
| Secure document exchange | Operations identifies the portal and help route. | The worker exchanges a fictional document with the intended test recipient and reports an unsafe link. |
| Seasonal cutoff | IT or the application owner implements the approved end action. | The cutoff test records actual denied access per system; an unexecuted task remains open. |
After the readiness process exists, use the onboarding and offboarding cleanup checklist to remove accumulated roles or forgotten seasonal access. Use the employee-access evidence review to check whether the approved decisions were actually applied and retested. ALLMSP’s managed IT services can help implement the approved account, device and support workflow.
Frequently Asked Questions
What information should a CPA firm collect before creating a worker account?
Provide a stable worker identifier, verified work identity, manager, role, approved clients and applications, start date, cutoff or review date, device and approving owners. State separately whether the person may prepare, review, transmit or release work. Keep tax identifiers, background-check documents and other employment details out of an ordinary IT request unless the approved process specifically needs them.
Should seasonal tax employees receive reused or shared accounts?
Give each person their own traceable identity. A returning worker may resume their own disabled account after identity, role, client assignments, recovery and end date are reviewed; do not hand that account to a different person. Remove last season’s access before adding this season’s assignments. A new password alone will not correct inherited groups, sharing or application permissions.
How should CPA firms assign employees to client records and portals?
Use the current engagement roster and a manager-approved client list. Check the application role, folder inheritance, group membership, shared links, search and exports with authorized test records. Confirm both an allowed client and an unrelated client. Access to one portal does not establish the correct permissions in tax software, workpapers, payroll or document storage.
Which permissions should CPA firms withhold from seasonal and junior employees?
Grant the duties actually approved for the role. A seasonal preparer may need to create a draft without independently reviewing it, transmitting a return, releasing payroll, changing bank details or administering the application. Test those boundaries in a safe training environment. Job title alone is not the permission rule; document any exception, approving owner and expiration.
What should a financial firm configure on a new employee device?
Check device ownership and enrollment, supported updates, encryption and recovery custody, endpoint protection, approved applications and the user’s ordinary privileges. Test the real portal, scanner and remote-work path with fictional documents. Record the support route and return arrangements. A device appearing in inventory is not enough if its security controls or the worker’s required applications have not been checked.
What secure communication training should new accounting employees receive?
Have the worker request and return a fictional sensitive document through the approved portal, verify the recipient, recognize an unsafe public link and handle a client who cannot use the normal route. Include email notifications and scanner destinations in the exercise. Teach where to report a mistaken recipient or exposed file, instead of relying only on a confidentiality acknowledgment.
Which security topics should CPA firm onboarding cover?
Practice the decisions the role will face: a changed bank instruction, a fake tax notice, a suspicious portal invitation, a lost device and a request to place client data in an unapproved AI tool. Ask the worker to use the actual reporting and verification route with test data. Record which action they demonstrated and who will resolve any gap before sensitive access is expanded.
How should tax firms manage seasonal employee access expiration?
Put the approved cutoff, owner and extension procedure in the roster, then configure and test the actual disabling or deprovisioning task for each system. An end-date field is only a record until an implemented process acts on it. If automation is unavailable, assign the manual action and verification. An exception report identifies unfinished work; it does not prove access was closed.
How should a CPA firm handle access during employee leave or role changes?
Decide which old duties end and which temporary duties begin, with a manager and review date. Transfer client deadlines and use supported delegation for mailbox or queue coverage. Remove obsolete access rather than adding new permissions on top of it. When the person returns or changes role again, review the temporary delegation and client groups instead of leaving coverage access permanent.
What should a CPA firm include in employee offboarding?
Enforce the authorized cutoff, block the relevant sign-in paths and address sessions and application-specific access. Preserve required records and arrange handoffs through authorized administrators; do not keep the departing person’s login active to finish the transfer. Verify tax portals, payroll authority, remote tools, recovery and devices separately. Account or license deletion comes after the firm’s preservation and ownership decisions.
Sources
- IRS Publication 4557, Safeguarding Taxpayer Data (May 2024): employee access and training guidance ↩
- Microsoft Learn: automate employee onboarding tasks with Lifecycle Workflows ↩
- Microsoft Learn: revoke user access, including token and application-session limitations ↩
- Microsoft Learn: remove a former employee, with separate access and data-preservation steps ↩
