Leftover Admin access
Leftover Admin access: leavers with 2FA, collaborators vs the bill, preview vs publish
Staff Access Audit Guard (Shopify App Store) is a Shopify app that reviews installed app access and granted scopes — including AI and agentic apps — flags protected customer-data and broad-write access, scores the store Low to High (higher is safer), and tracks staff and collaborator access with review reminders, without reading customer or order data.
Related: Agentic Catalog by momiji — Crawler rules and complete product JSON-LD for shopping agents.
The leftover Admin access checklist scores whether a former staffer still holds the only 2FA, whether a collaborator can edit the store while org billing stays on the merchant account, and who can publish a live theme versus only preview. Scoring stays in the browser. Admin is not scraped.
A former employee still has access to Shopify — what do I remove?
- Open Settings > Users and select the user. Deactivate stops them logging in. Actions > Remove is permanent and can't be undone. Shopify documents both steps in Managing users.
- For collaborators, the Help Center documents automatic expiry only when they have not logged in for 90 days. Removal is a separate, deliberate step. Staff accounts do not expire that way. See collaborator accounts. If Actions → Suspend returns “Cannot suspend or reactivate collaborators,” that is expected — use Remove, not staff Suspend. Dedicated steps: Cannot suspend a Shopify collaborator — remove access instead.
- Before removal, check what they could change: roles (publish a live theme versus only preview), 2FA on shared logins, and apps they installed. Then score leftover access on the nine-question self-score on this page. The score is leftover-access hygiene, not a security attestation.
- If the same review should re-run, the live listing gives an audit score plus 30/90-day review reminders for staff and collaborators. It does not revoke or remove anyone. See the app listing for current plans.
Install Staff Access Audit Guard
No install is required for the score. Install is the path if the same review should re-run when people or scopes move.
Parent guide: permission drift is not a one-time user list. Adjacent jobs: PO box blocker · CRA duty records.
What the leftover Admin access checklist scores
The leftover Admin access checklist scores nine questions, and each gap answer adds one point, so the total is leftover-access hygiene for staff, collaborators, and publish rights, not a security grade. Users and permissions is a snapshot; the checklist asks whether that snapshot still matches who can sign in, who can publish, and who the merchant still pays for.
| Pain people post | Question the leftover Admin access checklist asks |
|---|---|
| Former staffer holds the only 2FA | Is the authenticator still on a device you no longer control? |
| Collaborator access vs org billing | Can someone edit the store while the bill stays on your org? |
| Preview theme vs publish | Who can publish live, not only preview, since the last leave? |
Answer these leftover-access questions
A merchant picks one answer per leftover-access question, and scoring stays in the browser with nothing posted and no Admin API called. The leftover Admin access checklist cannot see Users and permissions, revoke staff, or uninstall apps; install is only if a re-runnable review is needed after people or scopes move.
After the score: keep a review you can re-run
A merchant keeps a leftover-access review that can re-run by installing Access Audit Guard, waiting for the first audit, reviewing staff and collaborator reminders, and exporting evidence on plans that include those exports. The leftover Admin access checklist is a one-pass self-score and goes stale when someone leaves or publish rights move.
- Open the Staff Access Audit Guard listing (
apps.shopify.com/momiji-access-audit) and install it on the store you just scored. - Wait for the first audit on install, or run another now.
- Review staff and collaborator reminders, and apps that can touch customer or order data.
- Export evidence on the plans that include those exports. Re-run when owners, scopes, or costs change.
Access Audit Guard scores and flags access already granted. The app does not revoke staff, uninstall apps, or attest that the store is secure. Confirm plan details on the live listing. The leftover Admin access checklist does not add prices.
Install Staff Access Audit Guard
Live listing: apps.shopify.com/momiji-access-audit.
What the leftover Admin access checklist is not
The leftover Admin access checklist is a browser self-score of leftover 2FA, collaborator billing, and publish rights. The checklist is not a generic security audit, SOC report, or attestation that the store is secure, and is not employee monitoring, a customer-data export, or attorney advice.
- Not a generic security audit, SOC report, or attestation that the store is secure.
- Not employee monitoring, and not a customer-data or order-body export.
- Not attorney advice. The leftover Admin access score is not legal advice.
- Not a store scrape. Answers stay in the browser.
- Not a B2B purchase-order rule. That job is require a PO number on B2B checkout.
Do I need to install an app to run this leftover Admin access checklist?
No: the leftover Admin access checklist scores answers a merchant types, sends nothing to a store, and scrapes nothing from Admin. Install is only if a merchant wants a re-runnable review with reminders and an export to keep after people or scopes move.
What does this leftover Admin access checklist score?
The leftover Admin access checklist scores review hygiene for staff, collaborators, and installed-app scopes, including whether customer-data access is inventoried and whether a dated export exists. The score is not a security grade, not a SOC report, and not an attestation that the store is secure.
Does a high score mean the store is secure?
No: a low gap count only means the merchant said the last review, collaborator cadence, and app-scope inventory are current, and the leftover Admin access checklist cannot see Admin, revoke staff, or uninstall apps. The score is leftover-access hygiene, not a security attestation.
Is the leftover Admin access checklist a security audit or employee monitoring?
Neither: the leftover Admin access questions cover a former staffer holding the only 2FA, collaborator access versus org billing, and who can publish a theme versus only preview. The checklist is not a generic security audit and not employee monitoring.
Where do I keep an ongoing leftover-access review?
Use an access audit that re-checks staff, collaborators, and installed-app scopes after the last review and can export evidence; Staff Access Audit Guard is the App Store listing already used on momiji-space for that job. Open the listing, install, wait for the first audit, then export if a file is needed. Confirm live listing text rather than the leftover Admin access checklist.
Related pages
- Hide past POS order history from temporary staff
- Staff permission drift access audit — snapshot vs a recurring review
- Cannot suspend a collaborator — remove access instead — staff Suspend vs collaborator Remove
- Staff access audit install page
- Staff Access Audit Guard — live App Store listing
- Cyber Resilience Act duty records — product cybersecurity duties, not staff scopes
- Shopify apps hub
- Tools
Build a printable review list with the free staff access review checklist generator.
Paste an app's scopes into the free app access scope reader.
Not legal advice. Not a security attestation. Not employee monitoring. The score is from answers you give; you choose what to change. The app scores and flags access you already granted.