SSO deactivation is the action of disabling a user’s federated login through an identity provider. It blocks the next authentication attempt through that path, but it does not automatically remove application accounts, revoke tokens, or end active sessions inside downstream tools.
Expanded Definition
SSO deactivation is a federated access control action, not a full identity teardown. In practice, it stops the next sign-in through the identity provider, but downstream application accounts, refresh tokens, cached sessions, and delegated permissions may remain active until they are separately revoked. That distinction matters in NHI and workforce IAM because federation often masks where authority is actually enforced. Guidance varies across vendors on whether deactivation should also trigger token revocation, session invalidation, or app-level deprovisioning, so the operational meaning must be defined in policy rather than assumed. The clearest reference point is NIST SP 800-53 Rev 5 Security and Privacy Controls, which separates authentication, session control, and account management responsibilities. In NHI environments, the same logic applies when an AI agent or service account inherits access through federation. The most common misapplication is treating IdP deactivation as complete offboarding, which occurs when teams disable SSO access but fail to revoke downstream entitlements and valid sessions.
Examples and Use Cases
Implementing SSO deactivation rigorously often introduces coordination overhead, requiring organisations to weigh rapid access cutoff against the cost of downstream cleanup and auditability.
- A departing employee’s IdP login is disabled, but the SaaS finance app still accepts an existing session until its own timeout expires.
- An engineer moved to a new role loses SSO access, yet a long-lived API token in a CI/CD tool continues to authenticate until manually revoked.
- An incident responder deactivates federated access to contain suspected compromise, then follows with token revocation and application account disablement.
- A service account used by an AI agent is removed from the IdP, but the agent keeps operating because its app-native credential was never rotated.
- Teams use offboarding runbooks aligned to the Ultimate Guide to NHIs and map the same workflow to session and account controls in NIST SP 800-53 Rev 5 Security and Privacy Controls.
In mature environments, deactivation is paired with explicit checks for application entitlements, refresh token invalidation, and privileged delegation paths, especially where federated access is only one layer of the trust model.
Why It Matters in NHI Security
SSO deactivation is critical because NHI compromise often survives beyond the initial access path. NHI Management Group notes that only 20% of organisations have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, which helps explain why disabling SSO alone rarely contains exposure. The same gap appears in broader identity hygiene: the Ultimate Guide to NHIs shows that 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage. That pattern is relevant when federated access is just the front door to tools that still trust cached credentials or app-local sessions. For governance, SSO deactivation must be paired with credential lifecycle controls, session invalidation, and entitlement review to reduce persistence after termination or compromise. Organisations typically encounter the full blast radius only after a breach investigation or failed offboarding audit, at which point SSO deactivation becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IAL/AAL | Federated access still depends on identity assurance and authenticator handling across the lifecycle. |
| NIST CSF 2.0 | PR.AC | Access control governance requires disabling access and validating that permissions no longer function. |
| OWASP Non-Human Identity Top 10 | NHI-04 | Offboarding and revocation gaps are central to non-human identity exposure and lingering access. |
| NIST Zero Trust (SP 800-207) | SC-Device / continuous verification | Zero Trust requires continuous verification, so access removal must be enforced beyond the login gateway. |
| CSA MAESTRO | Agentic systems need lifecycle controls that stop delegated access when authority is withdrawn. |
Treat SSO deactivation as one step in lifecycle assurance and follow with revocation of downstream access paths.
