How to Give Seasonal Staff Zero Trust Access That Expires

Every busy season, CPA firms hand seasonal preparers, reviewers and interns access to the most sensitive data they hold: Social Security numbers, bank details and full returns. The work ends in April or October. The access often does not. This guide shows how to set up seasonal staff access through zero trust, limited to the applications each person needs, with an end date built in from the first day.

Why is seasonal staff access a risk for CPA firms?

Seasonal and temporary employee accounts get broad access during the busiest weeks of the year and are often left active after the person leaves. An unused account with a known password and no owner watching it is an easy way into client data.

The IRS sample plan for tax practices treats this as a basic control. IRS Publication 5708 includes the model policy statement that "all new employees will be trained before PII access is granted" and that terminated employees' computer access logins and passwords "will be disabled at the time of termination." It also extends annual training to temporary and contract employees who have access to PII, and notes that "having a systematic process for closing down user rights is just as important as granting them."

What do the rules say about access for temporary staff?

The FTC Safeguards Rule sets access, MFA and monitoring requirements that apply to every user, with no carve-out for seasonal workers. Tax preparation firms are covered as financial institutions under 16 CFR 314.2(h)(2)(viii).

Three parts of 16 CFR 314.4(c) matter most for temporary staff:

• Paragraph (c)(1) requires access controls that permit access only to authorized users and limit each user to the customer information needed for their duties.
• Paragraph (c)(5) requires multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves an equivalent or stronger control in writing.
• Paragraph (c)(8) requires controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of customer information.

A seasonal preparer who can reach the whole file server, signs in with only a password, or keeps a working login into May sits outside all three. For a broader look at authentication gaps, see how to close MFA gaps before tax season.

How is zero trust access different from giving seasonal staff the VPN?

A VPN puts the seasonal worker on the office network. Zero trust network access (ZTNA) connects a verified person on a checked device to a short list of named applications and nothing else.

NIST SP 800-207 describes zero trust as granting no implicit trust based on network location. In practice, a ZTNA service lets you publish the tax software server, the document portal and the scanning share as separate applications and assign each one to a group. In Microsoft's version, Entra Private Access, each application is defined by destination, port and protocol and reached through a connector that makes only outbound connections. Other ZTNA products work on the same principle.

The difference shows up when something goes wrong. If a seasonal password is phished, the attacker gets the two or three applications that role was granted, through a service that logs each connection, rather than a foothold on the whole network.

How do you make access expire automatically?

Set the end date when you create the access, not when the person leaves. Then the system removes access on schedule even if nobody remembers.

In Microsoft 365 there are three ways to do this, depending on licensing:

• Access packages with an expiration date. Entra entitlement management lets you bundle the seasonal group, applications and SharePoint sites into one access package and set assignments to expire on a date, after a number of days or after a number of hours. Users are notified 14 days and one day before expiration, and extensions can require approval. As of October 2026, Microsoft's licensing guide lists this under Entra ID P2 or Entra ID Governance.
• Leaver workflows tied to a last day. Entra Lifecycle Workflows include an "Offboard an employee" template that runs on the date stored in the user's employeeLeaveDateTime attribute and, by default, disables the account and removes it from all groups and Teams. A post-offboarding template can remove licenses later. As of October 2026, Microsoft lists Lifecycle Workflows under Entra ID Governance or Entra Suite.
• A seasonal group and a calendar. Firms on Business Premium alone can put every seasonal user in one group that all ZTNA applications and Conditional Access policies target, record each end date at hiring, and have a named person disable the accounts on that date. It is manual, so it needs a backup owner.

If your firm uses a different identity platform, look for the same two features: time-bound access assignments and scheduled account disablement.

What are the steps to set up expiring zero trust access?

Follow these steps before the first seasonal hire starts:

1. Define the seasonal role. List the applications it needs, such as tax software, the document portal and email, and the ones it does not, such as the full file server, payroll and firm finances.
2. Create named accounts with the end date recorded at creation, either in the access package or the leave date attribute. Never share a login between seasonal staff.
3. Require MFA at first sign-in, using an authenticator app or passkey rather than text messages where you can.
4. Train before access. Pub 5708's model language calls for training before PII access, and the training should include the firm's AI rules. See how to write an AI policy that covers seasonal staff and interns.
5. Decide on devices. A firm laptop enrolled in device management is the cleanest option. If a personal Windows PC is unavoidable, Conditional Access can require an app protection policy in Edge so firm data stays inside a managed browser profile.
6. Publish only the role's applications through ZTNA and assign them to the seasonal group, not to individual users.
7. Watch sign-ins during the season. Entra keeps sign-in logs for 7 days on the free tier and 30 days on P1 and P2, so export them if your WISP calls for longer retention.
8. Verify the expiration. On the end date, confirm the account is disabled, the device is returned and wiped, and any client files the person saved are filed in the right place.

What about seasonal staff who come back next year?

Re-enable the account with a new end date rather than leaving it active over the summer. Disabling keeps the account's history and group design intact, so bringing someone back takes minutes.

When a returning preparer is re-enabled, repeat the training and the device check. Software, client lists and the firm's AI rules may have changed since last season.

What should CPA firms do before busy season?

Use the weeks before busy season to set up seasonal staff access once and reuse it every year:

• Pull a list of last season's temporary accounts and confirm each one is disabled.
• Check which Entra licenses the firm owns, since that decides whether expiration can be automatic.
• Build the seasonal group and the short list of applications it can reach through ZTNA.
• Write the onboarding and offboarding steps into your WISP. Our guide to updating your WISP before the 2027 filing season covers what else belongs there.
• Test with one dummy account set to expire in 48 hours and confirm it loses access on time.

How can s90 help?

s90 sets up zero trust network access for CPA firms in Los Angeles and Orange County, including seasonal roles with end dates, MFA and device checks, and records the controls in your WISP so they are ready for a Safeguards Rule review. If you want a second look at last season's accounts before you hire again, we are happy to walk through it with you.