What to do if…
you lose access to a shared workspace because your role was changed without warning
Short answer
Assume this is either an admin change or a security containment step: stop trying random fixes, capture the error, and contact your IT/help desk and manager right away to confirm the change and restore the access you need.
Do not do these things
- Do not bypass controls (borrow logins, use personal email/cloud, or copy data out “just in case”).
- Do not keep hammering sign-in/MFA — repeated failures can trigger automated lockouts and look like an attack.
- Do not post accusations in public channels; keep it factual and private until confirmed.
- Do not install unapproved software/extensions to regain access.
- Do not delete messages/files in panic.
What to do now
-
Write down what you’re seeing (2 minutes).
Note the time, the tool/workspace, whether you’re blocked at sign-in or at specific resources, and the exact error text. Take a screenshot if your org allows it. -
Separate “account disabled” from “permission removed.”
- If you can’t authenticate (password/MFA/account disabled): it’s identity access.
- If you authenticate but can’t see channels/folders/projects: it’s usually role/group membership.
-
Contact IT/help desk using security-safe, audit-friendly language.
Use: “My access appears to have changed without warning; I lost access to [workspace] required for current work. Please confirm whether my account was disabled or permissions were changed, restore required access, and tell me if this was a security action.”
Ask for a ticket number and who owns the change (IT, security, or app admin). -
Notify your manager (in writing) and ask for confirmation.
“I suddenly lost access to [workspace]. IT ticket #____ is open. Can you confirm whether my role/permissions were changed and what you need from me?”
This creates a clean record and reduces rumor. -
If compromise is possible, treat it like an incident and follow your org’s incident channel.
If you see unexpected MFA prompts, unfamiliar device/session notices, password reset emails you didn’t initiate, or unusual sign-in alerts:- Escalate to your security/IT incident channel as suspected account compromise.
- Ask them to confirm whether a security control restricted your access and to revoke active sessions/force sign-out as appropriate.
- Avoid using untrusted devices until IT clears them.
-
If you were an admin/owner and operations are blocked, request formal recovery steps.
Ask IT/security to use the organization’s admin recovery / break-glass process and to reassign ownership or restore a suspended/deactivated user through official admin consoles, with logging. -
Preserve work continuity without moving restricted data.
- List what’s blocked today (deliverables, approvals, access-dependent tasks).
- Work on what you can offline on approved systems only.
- Let the project owner know you’re blocked pending IT restoration (impact-only message).
-
If pay/timekeeping could be affected, protect a basic record now.
If you can’t access your normal timekeeping or work systems, keep your own note of when you were working and what was blocked, and notify your manager/HR/payroll that access issues may affect reporting for today. Keep it factual and minimal. -
If this might be an HR/employment action, keep the first hour focused on clarity.
Ask HR or your manager for written confirmation of any role change that affects your tools/access and who to coordinate with for day-to-day work. Deeper legal/HR questions can come later; right now you’re stabilizing access and documentation.
What can wait
- You do not need to decide right now whether this is disciplinary, restructuring, or a mistake.
- You do not need to broadcast the issue broadly or defend yourself in group chats.
- You do not need to purge accounts, files, or messages.
- You do not need to “fix it yourself” — official restore is safer and leaves an audit trail.
Important reassurance
Unexpected access loss happens frequently due to org changes, app licensing, group-policy updates, admin errors, or automated security controls. Your job in the moment is to avoid risky workarounds, document what happened, and route the fix through IT/security and your manager.
Scope note
This is first-step guidance to reduce harm and restore a stable situation. Follow-on steps (policy review, HR escalation, formal complaints) may matter later, but they’re not the priority in the first hour.
Important note
This guide is general information, not legal, HR, or cybersecurity advice. Follow your organization’s policies and use official IT/security channels for account recovery and incident reporting.
Additional Resources
- https://csrc.nist.gov/pubs/sp/800/61/r3/final
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
- https://www.cisa.gov/reporting-cyber-incident
- https://www.cisa.gov/topics/cyber-threats-and-response/incident-response
- https://consumer.ftc.gov/how-recover-your-hacked-email-or-social-media-account
- https://slack.com/help/articles/360055665434-Reactivate-your-Slack-account
- https://knowledge.workspace.google.com/admin/users/restore-a-suspended-user