Tenants tell the base building when somebody joins. Almost nobody tells it when somebody leaves. The distance between those two facts is measured in orphaned credentials.
By Nick Venuti, Senior Director of Product Marketing · September 2026 · 8 min read
Ask a property manager how a tenant employee gets access on their first day and the answer is immediate and detailed. Ask how it is removed on their last day and the answer gets vague. This is structural, not negligent. A tenant has every reason to report a joiner, because that person cannot work until the badge exists, and almost no reason to report a leaver, because nothing in the tenant’s own week breaks if they do not. Orphaned credentials are what collects in that gap.
How orphaned credentials accumulate
The tenant does offboard the person. The account is disabled, the laptop comes back, and if the tenant runs its own access control system inside the suite, the badge stops working at the suite door that afternoon. Nothing at all happens in the base building system, because it is not on the tenant’s offboarding checklist and never has been. It belongs to a different company.
Ownership is the real problem. Property management cannot see tenant employment events, so it cannot act on them. The tenant assumes the building handles building access, because the building issued the credential. Both positions are reasonable, and the result is that nobody reconciles anything. The records that follow are predictable: a tenant vacates and its whole population stays live, because nothing in the lease termination triggers a sweep. A fit-out crew is added as a batch of twenty and never removed as one. Somebody re-badges after losing a card and now holds two active records.
- Departures in the tenant HR system or identity provider
- Contractor and vendor work orders reaching their end date
- Lease changes, suite moves and tenant exits
- The tenant roster as it stands this morning
- Compares the base building population against current tenant rosters
- Expires on the dates the tenant record already carries
- Surfaces records with no matching person on any roster
- Records what changed, when, and which source drove it
- Base building access control system
- Lobby turnstiles and shared amenity doors
- Elevator floor groups and destination dispatch
- Mobile credentials still in circulation
Reconciliation runs on a schedule rather than on a reminder, so orphaned credentials surface as a worklist rather than during an access review.
Two halves of the same gap
Revoking a badge is not the same as revoking access, and in a building with an elevator bank the difference is a floor.
Where the elevator group maintains its own population, removing somebody from the access control system does not remove them from the elevator. The badge stops opening the turnstile and still places a call to the floor. That is the half of the revocation nobody tests.
- Floor rights derived from the access group, not held separately
- Revocation reaches doors and floors on the same event
- Destination dispatch and traditional hall-call alike
- 10+ elevator manufacturers integrated
- A vacated suite does not leave floor rights behind
Where braXos has the deepest bench. 10+ years of vertical access across multi-tower portfolios.
A scheduled comparison between the base building population and what each tenant currently says is true does not depend on anyone remembering to send an email. Orphaned credentials surface as exceptions instead of sitting quietly until somebody goes looking.
- Base building population compared against live tenant rosters
- Expiration dates carried from the tenant record or work order
- Records with no matching source surfaced as exceptions
- Tenant exits handled as a population, not one name at a time
- Provisioning activity recorded with a timestamp, source and change detail
The same layer reaches everything else. 200+ pre-built connectors, 50+ of them for access control.
What a first reconciliation usually finds
The first full comparison between a base building population and current tenant rosters is the most informative hour of the project, and it is worth running before committing to an architecture. The categories of orphaned credentials are consistent enough to predict: records with no matching person on any current roster; whole populations belonging to a tenant that vacated at some point nobody can date; contractor batches months past the work order that created them; several active records for one person, accumulated across re-badging; and access levels granted for a temporary reason that has now been temporary for three years. None of that means the building was run badly. It means it was run manually, by people never given a feed of the events they would have needed to act on.
Four orphaned credentials that still work
Door access was removed when somebody finally reported the departure. The elevator group kept its own list and was never told, so the credential no longer opens the turnstile and still calls the car to the fourteenth floor.
A tenant vacates and the suite is re-let. The previous tenant’s population still carries floor authorization to a floor now occupied by a different company, and nothing in the lease termination triggered a review.
Eighteen contractors were added during a build-out with no end date, because the schedule was uncertain at the time. The works finished eight months ago, the batch was never revisited, and no report exists that would surface it.
Somebody was re-badged three times over five years, after a lost card, a name change and a move between suites. Four records exist, three are active, and a roster comparison matches only the current spelling.
How a reconciliation runs
A full read of the base building population: access levels, activation and expiration dates, and elevator floor groups. This baseline usually surprises people.
Rosters arrive from whichever source the tenant can offer: an HR platform, an identity provider, or the Symphony portal. Exceptions come out as a worklist grouped by tenant, so each one can be sent the part that belongs to it.
Once the baseline is clean, the same comparison runs on a schedule and tenant-side events flow through as they happen. The cleanup becomes a standing condition rather than an annual exercise.
Integration detail
Most buildings cannot say how many orphaned credentials they hold for people who no longer work for any tenant in the building. The number is not zero, and the only way to find it is to look.
Part of a wider ecosystem
The same connection that reconciles the base building population drives the systems downstream of it. A record retired in the access control system is retired in the elevator group, in visitor management and in parking on the same event, rather than in four separate cleanups that each need an owner. That is the practical argument for doing the identity work once.
Find out what your building is still holding
A first reconciliation against current tenant rosters is a short exercise and the only way to size how many orphaned credentials you hold. Talk to us about running one, or browse the connector library to see what is already built for your systems.
Run a first reconciliationMore on the platform in the braXos connector library, or see the rest of the Symphony Series.
Visit us at www.braXos.com | [email protected]
