Echoing a lot of people here but... Password manager like 1Password, for the few passwords that do need to be managed SSO as much as possible. Fewer places t

Echoing a lot of people here but... Password manager like 1Password, for the few passwords that do need to be managed SSO as much as possible. Fewer places to manage access = easier onboarding and off boarding In general you want to use role based access control. I'm not familiar with off the shelf solutions, but the concept is that you grant people access to systems according to what they need for their job (role). A role in this case may be a team, or a specific job on that team (e.g. engineers on xxx product team). Then e.g. when that team has to add another engineer to their oncall rotation, they give them access associated to that role. When person moves off the team access gets removed. when the team realizes they need another permission to troubleshoot their systems, everyone in that role on the team gets it. Etc.