🔐 Strong passwords, and who’s watching the door
This post is part of our Cybersecurity Awareness Month series, built around four core topics. This is the last one. Missed the others? Start with the first post on reporting scams, then read MFA via SSO.
A strong, unique password is the habit everyone knows, and it still matters. In the Verizon 2026 DBIR, a median of 4% of Active Directory users had a password that already appeared in breach data. Less than 1% had one that failed basic complexity rules. Leaked passwords are a bigger problem than weak ones.
As an application manager, you don’t need to repeat the advice. You can make the good habit the easy one, for two groups.
End users
Let them sort out a forgotten password themselves, without opening a ticket. You can switch on “Users can reset their password” in the login settings for the Self-Service Portal. Do you use SSO? Then the password lives with your identity provider, so the reset happens there.
Operators
Same idea, higher stakes. An operator account usually touches far more data than an end-user account. Set a sensible minimum password length for the Operator Section, and add SSO with MFA on top. Our MFA via SSO post shows how.
Offboarding
Is where it quietly falls apart. A leaver rarely has access to just one system, so it helps to look at TOPdesk and everything else separately.
In TOPdesk: since the May 2026 update, the Person card has a “Has access to the Self-Service Portal” checkbox. You can change it on the card, through the person import, or through the API. So “revoke SSP access” no longer has to be a step someone remembers, or forgets, on a leaver’s last day. You can automate it. If your HR system already talks to TOPdesk, set this up properly instead of leaving it on a checklist. Use your identity management tool, or any integration that can call the Person API. The moment HR marks someone as a leaver, access to the Self-Service Portal closes by itself.
Beyond TOPdesk: think of email, your HR and finance tools, shared drives and everything else a leaver could still sign in to. The same idea applies. If those applications sit behind your identity provider, disabling the account there removes the main way in. Applications outside SSO still need their own step, so it’s worth knowing which ones they are.
Not sure how your login settings are set up? Search the My TOPdesk knowledge base or ask your consultant.
Your turn
We’d love to learn from your setup. Tell us in the comments:
- In TOPdesk: is removing a leaver’s access automatic, or does someone still have to remember it?
- Beyond TOPdesk: how do you handle access to other software when someone leaves? Which tools or integrations do you use, and which applications are the hardest to cover?