This is still a hard problem. I use Google Apps OAuth for everything possible. This makes it pretty easy. You can also use SAML or any other SSO mechanism. Yo

This is still a hard problem. I use Google Apps OAuth for everything possible. This makes it pretty easy. You can also use SAML or any other SSO mechanism. You should absolutely create new users when that is an option. Then, when someone leaves, it's easy to remove access without having to worry about things. We use Lastpass to store all company passwords, and there are some shares done through it as well, but we don't share unless we have to. If you are sharing an account with someone you should change the password for that account when they leave the company. If you're using something like Lastpass or similar this is easier to do than distributing the password another way.