Add a contractor account with an automatic access end date

TL;DR — The safest way to add a contractor is to create a separate account, put it in a contractor-only group with the minimum permissions it needs, and set an account expiration date in your identity provider (the service that manages logins), such as Microsoft Entra ID or Google Workspace. If your provider does not support automatic expiration directly, use a calendar reminder plus a temporary group membership feature if available. Reading time: ~5 min

Goal

When you finish, the contractor will have their own login, only the access you intended, and a defined end date after which they can no longer sign in or use the assigned apps without you manually removing them.

Prerequisites

• An admin account in your identity provider: Microsoft Entra ID, Google Workspace, Okta, or your company's equivalent
• Permission to create users and manage groups or app access
• The contractor's full name and email address
• The contractor's start date and exact end date
• A list of the apps or systems they need access to
• If you use Microsoft 365 or Google Workspace, access to the admin dashboard in a web browser updated within the last year

Steps

Step 1: Create a separate contractor account

Use your identity provider's admin dashboard, not a shared login.

Common menu paths:

• Microsoft Entra admin center: Identity → Users → All users → New user
• Google Admin console: Directory → Users → Add new user
• Okta Admin Console: Directory → People → Add person

Enter these literal values where the form asks for them:

• First name: contractor's first name
• Last name: contractor's last name
• Display name: First Last (Contractor)
• Username/email: first.last.contractor@yourcompany.com or your normal naming format
• Account type/employee type/description: Contractor

If your system asks for a password, generate one and send it through your normal secure channel.

What you should see: the new user appears in the user list with a unique username and a status such as Active, Invited, or Pending first sign-in.

Step 2: Put the contractor in a contractor-only group

Create one group for contractors if you do not already have one, then assign access to that group instead of to the user directly.

Common menu paths:

• Microsoft Entra admin center: Identity → Groups → New group
• Google Admin console: Directory → Groups → Create group
• Okta Admin Console: Directory → Groups → Add group

Use these literal values:

• Group name: Contractors-Temporary
• Description: Temporary access for contractor accounts with end dates

Then add the new user to that group.

What you should see: the user is listed as a member of Contractors-Temporary.

Step 3: Assign only the apps this contractor needs

In your identity provider or app admin panel, assign access to the group Contractors-Temporary only for the required apps.

Common menu paths:

• Microsoft Entra admin center: Identity → Applications → Enterprise applications → [App name] → Users and groups → Add user/group
• Google Admin console: Apps → Web and mobile apps → [App name] → User access
• Okta Admin Console: Applications → Applications → [App name] → Assignments

Use these literal actions:

1. Open each required app.
2. Add the group Contractors-Temporary.
3. Set the role to the lowest available level, such as Viewer, Member, or Read only.
4. Do not assign Admin, Owner, or Super Admin unless the work truly requires it.

What you should see: the app's assignment list shows Contractors-Temporary with a non-admin role.

Step 4: Set the access to end automatically

Pick the subsection that matches your identity provider.

Microsoft Entra ID / Microsoft 365

Use access packages or entitlement management if your tenant has it, because it supports an explicit expiration date.

Menu path:

• Microsoft Entra admin center → Identity Governance → Entitlement management → Access packages → New access package

Use these literal values:

• Name: Contractor - [Project Name] - Ends YYYY-MM-DD
• Description: Temporary contractor access with automatic expiration
• Resources: add the group Contractors-Temporary and any app groups needed
• Assignment duration: Until date
• End date: the contractor's actual last day
• Expiration behavior: Remove all access

Then assign the contractor to that access package.

What you should see: the assignment details show a fixed end date and a status such as Delivered or Active.

Google Workspace

Google Workspace does not provide one universal automatic end-date control for every type of app assignment. Use a temporary group or role assignment if your edition supports it; otherwise create the user now and add a calendar task for removal on the end date.

Menu path:

• Google Admin console → Directory → Groups → Contractors-Temporary
• If your edition supports time-bound role assignments, use: Account → Admin roles → [Role] → Assign admins

Use these literal actions:

1. Add the contractor to Contractors-Temporary.
2. If a role assignment screen includes an end date field, enter the contractor's last day.
3. If there is no end date field, create a calendar event titled Disable contractor account: First Last for 9:00 AM on the end date.

What you should see: either the assignment shows an end date, or your calendar contains the removal task.

Okta

If your Okta setup includes lifecycle or access governance features, use a time-bound assignment. Otherwise use group-based access plus a scheduled deactivation task.

Menu path:

• Okta Admin Console → Applications → [App name] → Assignments
• Okta Admin Console → Directory → People → [User]

Use these literal actions:

1. Assign the contractor through Contractors-Temporary.
2. If your assignment UI includes Start date and End date, enter the exact dates.
3. If it does not, create a calendar event titled Deactivate contractor: First Last for the end date.

What you should see: either the assignment shows a start and end date, or your calendar contains the deactivation task.

Step 5: Block extra sign-in methods you do not want

If your identity provider allows it, require normal sign-in protections and avoid long-lived credentials.

Common menu paths:

• Microsoft Entra admin center: Protection → Authentication methods
• Google Admin console: Security → Authentication
• Okta Admin Console: Security → Authenticators

Use these literal actions:

1. Require MFA (multi-factor authentication, a second sign-in step) for the contractor account.
2. Do not create API keys, service accounts, or mailbox delegation unless the work specifically needs them.
3. If the contractor only needs browser access, leave SSH keys, VPN accounts, and local admin rights unassigned.

What you should see: the account has MFA required and no extra credentials beyond the apps you assigned.

Verify it works

Run these checks end to end:

1. Sign in as the contractor in a private/incognito browser window.
2. Open only the apps you assigned.
3. Confirm unassigned apps show Access denied, You need permission, or are absent from the app launcher.
4. Open the user or assignment details and confirm the end date is visible.

If your provider supports audit logs, check them here:

• Microsoft Entra admin center: Monitoring → Audit logs
• Google Admin console: Reporting → Audit and investigation
• Okta Admin Console: Reports → System Log

Expected result: successful sign-in to the allowed apps, denied access to everything else, and a visible expiration date or a scheduled deactivation task.

Common pitfalls

Adding the contractor directly to apps instead of to a group

Mistake: you assign the user one app at a time and skip the contractor group.

Symptom: when the contract ends, some access remains because one assignment was missed.

Fix: remove direct app assignments and reassign access only through Contractors-Temporary.

Reusing a shared account

Mistake: you give the contractor an existing team login.

Symptom: there is no clean way to expire only that person's access, and audit logs do not show who did what.

Fix: create a separate named user account like first.last.contractor@yourcompany.com.

Choosing an admin role out of convenience

Mistake: you assign Admin, Owner, or equivalent because it avoids permission errors.

Symptom: the contractor can change settings, invite users, or access data outside the project.

Fix: change the role to Viewer, Member, or the lowest non-admin role the app supports.

Assuming every provider has automatic expiration everywhere

Mistake: you expect every user, group, and app assignment screen to have an end date.

Symptom: you spend time looking for a field that is not available in your edition or product.

Fix: use the provider feature that does support expiration, such as Entra access packages, or create a dated deactivation task if no native end date exists.

Forgetting non-SSO access

Mistake: you remove the app assignment but leave VPN, SSH keys, API tokens, or mailbox delegation active.

Symptom: the contractor still reaches systems after the end date.

Fix: review the account for extra credentials and remove any VPN, SSH, token, and delegated mailbox access before the contract starts or on the end date.

---

This article was written by an AI system and published pending human review. Verify anything you intend to act on.