Employee Account Management Procedures

This document outlines a formal set of procedures the Division of Information Technology (DIT) uses to manage employee accounts. The university is required to manage accounts to keep our networks and data safe by ensuring only those who are authorized to access the university’s IT resources can do so. As part of that requirement, the DIT disables accounts and purges account content on an as-needed basis.

1. Account Disabling

Disabled, or deactivated, accounts do not have access to resources requiring your Morgan username and password such as Banner, WebSIS, Google Workspace (email, calendar, drive, etc.), Canvas, MSU-Secure (wi-fi), etc. A disabled account can be re-enabled as needed.

1.1 Account Deactivation Due to Involuntary Termination

Accounts will be disabled without prior notice for one or more of the following reasons:

• The account poses an imminent risk to the university’s computing resources resulting from an inappropriate activity or because a breach of log-in identity has occurred;
• the account holder is involved in a legal, judicial, disciplinary matter, or termination; or
• the account holder has passed away.

1.2 Account Deactivation Due to Voluntary Separation

An Employee Exit Clearance form must be submitted by the supervisor via Banner Workflow for employees who have informed their plan to separate or retire from the university. Employee accounts for those exiting the university under these terms, will be disabled within 24 hours of their official final work date.

1.3 Account and IT Resource Management after Voluntary Separation

In some cases, employees who separate or retire from the university still need access to university IT resources. These cases are handled as follows:

• Temporary Work Contract after Separation - Former employees who have a signed work contract on file with HR will be regranted access to their previous account with the access required to perform the contracted work duties. The former employee’s supervisor must submit a Special Data Access Request Form to request account reenabling.
• Volunteer Worker after Separation - Supervisors who have made arrangements with former employees to remain on board to conduct university business on a volunteer basis or to train a successor must complete the Special Access Request Form to request account reenabling.
• Special Access Request - A Special Data Access Request Form must be submitted when access to a former or current employee’s email, files on computer, files on Google Drive, etc. are needed. The request should be initiated by the immediate supervisor, Office of the General Counsel, Office of Human Resources, Office of Internal Audit, or an authorized requestor.
• Emeritus Status - The university President or Provost determines when a former employee is granted Emeritus status. Individuals who fall into this category can keep their university-assigned email account for life. If Emeritus status is not granted by the time of separation, the employee’s supervisor must complete the Special Access Request Form to extend the employee’s access to email.

The Special Access Request Form is accessible via this link as a DocuSign form.

2. Account Content Purging

Purging is a systematic action that permanently erases records, data, and/or identity. When the contents of a Morgan State University account is purged, the assigned email address continues to exist, but the account contents are deleted permanently (e.g., contacts, email, calendar events, Google Drive files, etc.). Employee account purging is not currently a university practice.

3. Dual Role Accounts

In 2016, the DIT implemented a ​dual role account ​model, separating student accounts from employee accounts for those individuals who are in both a student and an employee role. Since the roles are separate, employee accounts will be subject to the procedures outlined in this document whereas student accounts will be subject to the Student Account Management Procedures.