We have a private website for our clients which needs a username and password for login to see protected information. The users are created by ourselves by petition of our clients for some of their employees, and they must have a valid institutional email (not gmail.com, outlook.com, etc).
Recently we have discussed what to do if one of our client's employees quits or is fired, since our clients usually do not inform us if that happens. This means the account in our system could be compromised with the risk of having data leaks.
One of the solutions we have thought of is to do email 2FA. The reasons for this are:
- The passcode will always be sent to the institutional email. In theory, if one of our client's employees quits or is fired, the email would be disabled so they may no longer access our site.
- SMS or App 2FA requires a cell phone. However, we don't know whether our clients provide those to our users or they use their personal phones instead. If it is the latter, they will still have access after leaving.
Would it be acceptable for this use case? Am I missing something? Is there an alternative?