Key points
- A disabled account blocks new sign-ins. Sessions that apps already issued, OAuth grants and keys can outlive it.
- Remove access in a set order: sessions, groups and roles, MFA methods, OAuth grants, then credentials outside the directory.
- Apps outside single sign-on are where offboarding most often breaks. You cannot remove access you do not know about.
- Keep a record of what you removed and when. That record is the evidence an auditor asks for.
Why is disabling the account not enough?
When you disable an account in your identity provider, new sign-ins fail. Three kinds of access can survive that change.
- Sessions and tokens. An app that already issued a session can keep honoring it until it expires. Access tokens stay valid for their lifetime.
- OAuth grants. A third-party app the person authorized can keep acting with the scopes they gave it. The grant often outlives the account that approved it.
- Credentials outside the directory. Local accounts in SaaS apps, API keys, personal access tokens and shared passwords never passed through your identity provider.
The offboarding checklist
Before the last day
- Confirm the leaving date and time with HR, and name the manager who inherits the work.
- List every application the person uses. Include the apps they signed in to without SSO.
- Find the shared and service accounts they own, and give each one a new owner.
- Plan the handover of files, mailboxes and scheduled jobs.
On the last day
- Disable the account in your identity provider.
- Revoke the user's sessions and refresh tokens.
- Remove group memberships, directory roles and app assignments.
- Remove their MFA methods. A phone they keep should not be able to approve a sign-in.
- Remove the OAuth grants they approved for third-party apps.
- Disable their local accounts in apps outside SSO, and change any shared password they knew.
- Revoke their personal access tokens and API keys, in code platforms such as GitHub and in each SaaS admin console.
In the weeks after
- Watch for sign-in attempts on the disabled account. A success anywhere is an incident.
- Check the next access review for anything the checklist missed.
- Record what you removed, who removed it, and when. That record is your audit evidence.
Where does offboarding usually break?
- Apps outside SSO. If your identity provider never knew about an app, disabling the account does nothing there. Finding those apps is a discovery problem, and it comes first.
- Grants nobody reviews. OAuth consent takes one click to give. Few teams ever look at it again.
- Contractors. Their end date often lives in a contract, outside HR. Put the date on the account when you create it.
- Movers. A move between teams adds access, and the old access stays unless someone removes it. Treat a mover as a leaver from their old role.
How do you know it worked?
- The account shows no successful sign-in after the leaving date.
- No groups, roles or app assignments remain.
- No OAuth grants remain that the person approved.
- Each shared credential they knew has changed.
- The record shows who removed each item, and when.
How EnscureX handles a leaver
In Govern, a leaver workflow removes sessions, groups, apps, roles and grants in one run. It does that once you switch on those write-back tasks for the connection, and they ship switched off. Discover finds the apps your people use outside SSO. The list in step 2 then starts from data.
Frequently asked questions
How fast should offboarding happen?
Access should end on the last working day, at the hour the person leaves. For a dismissal, end it before the conversation or during it.
Does disabling an Entra ID account end active sessions?
It blocks new sign-ins. Microsoft's guidance is to revoke the user's sessions as a separate step, because apps can keep sessions and tokens they issued earlier.
What is the difference between deprovisioning and offboarding?
Deprovisioning removes accounts and access. Offboarding is the whole process around a leaver: access, devices, the handover of data, and the record of what happened.
Who should own the offboarding checklist?
HR starts it, IT runs it, and the manager confirms the handover. Security should look at the hard cases: shared accounts, admin roles and apps outside SSO.