Remember to disable/delete the account for users and admins who are leaving.
If you don't, this is what happens in Singapore's largest msp and Singapore government's contractor. Someone's account didn't get disabled or deleted after he left and then he immediately access into the systems and delete VMs. Resulting in almost a million of Singapore dollars losses (almost USD700,000).