TL;DR: Incomplete SaaS offboarding leaves orphaned licenses, lingering access, and compliance exposure, with 38% of employees admitting they have accessed a prior employer’s accounts after leaving and manual deprovisioning still taking about eight hours per leaver, according to 1Password and Ponemon Institute research. The control gap is not just identity revocation but lifecycle closure across apps, licenses, data transfer, and audit evidence.
At a glance
What this is: This is an analysis of SaaS offboarding failure that shows why revoking access is not enough when licences, data transfer, and unsanctioned apps remain outside IT control.
Why it matters: It matters because IAM and IGA teams need to govern the full leaver lifecycle across sanctioned and shadow SaaS, or they will keep paying for residual access and create compliance exposure.
By the numbers:
- 38% of employees have accessed a prior employer’s accounts after leaving the company.
- 500 employees, with a 15% annual turnover rate = 75 leavers per year.
Context
SaaS offboarding is the process of removing a departing worker’s access, reclaiming licences, and transferring any business assets they leave behind. In practice, many organisations only revoke access in the IdP and never close the loop across every app, licence, mailbox, and file store.
That gap matters because the modern SaaS estate is fragmented. Some apps sit outside SSO, others are connected only for access revocation, and shadow IT often remains invisible until turnover exposes the problem. For IAM and IGA teams, the issue is lifecycle governance across sanctioned and unsanctioned applications, not just user deprovisioning.
The article frames the result as wasted spend, compliance exposure, and residual access risk. It also shows why SaaS discovery has become part of offboarding, not a separate optimisation exercise.
Key questions
Q: What breaks when SaaS offboarding only removes SSO access?
A: Partial offboarding leaves residual risk because application-level permissions, active sessions, and data custody may still persist. A user can appear removed from the identity provider while remaining reachable in the application or through transferred data paths. Effective offboarding must verify that access is removed everywhere it exists.
Q: Why do incomplete leaver processes create both security and finance risk?
A: Because the same orphaned account can keep exposing data while also consuming an unused licence. Security teams inherit the access problem, finance teams inherit the waste, and neither can prove closure if the app was never fully inventoried or deprovisioned.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start. Confirm that accounts are disabled, tokens are revoked, privileged roles are removed, and recovery methods are no longer usable across every connected system. Sampling terminated identities is a practical way to prove whether revocation is real or only recorded.
Q: What is the difference between access revocation and lifecycle offboarding?
A: Access revocation removes the ability to sign in, while lifecycle offboarding closes the account, reclaims the licence, and transfers the business assets tied to that identity. In SaaS environments, the second control is the one that actually ends exposure and waste.
Technical breakdown
Why SSO-based offboarding only closes part of the SaaS estate
SSO and IdP workflows are useful only for the apps they can reach. Many SaaS services are never federated, and even when they are, the integration may revoke access without deleting the account or reclaiming the licence. That leaves a split state: the organisation believes the user is offboarded, but the vendor still sees an active subscription or dormant account. This is a lifecycle problem, not an authentication problem. The governance gap appears when the offboarding process is designed around session termination instead of full account and entitlement closure.
Practical implication: Treat federated access as one control point, then verify that account deletion and licence recovery happen in the downstream app.
Why shadow IT turns offboarding into a discovery problem
Shadow IT breaks the assumption that IT knows the full application estate before a leaver exits. If employees can add SaaS tools without approval, offboarding cannot rely on a static inventory or an IdP-only workflow. The technical issue is not simply hidden spend. It is hidden identity surfaces, where OAuth grants, business-system integrations, and personal app usage can persist beyond employment. That makes offboarding dependent on continuous discovery, not periodic cleanup. Without discovery, the deprovisioning workflow only touches the part of the estate that was already known.
Practical implication: Continuously reconcile app usage, OAuth grants, and business-system connections against the approved inventory before offboarding starts.
Why licence reclamation and data transfer belong in the same workflow
A complete leaver workflow has to separate access removal from business continuity. Revoking access without transferring files, redirecting email, or reallocating licences can leave data stranded and business processes interrupted. The article shows that offboarding is not complete when the account disappears if the organisation still needs the information, the inbox, or the licence seat. That is why licence repurposing and asset handoff are governance functions, not administrative extras. The architecture has to support both containment and continuity in the same offboarding path.
Practical implication: Build offboarding runbooks that transfer ownership, archive records, and reclaim licences as one controlled sequence.
Threat narrative
Attacker objective: The objective is to retain unauthorised access to business applications and data after employment ends, while the organisation continues to carry the cost and risk.
- Entry occurs when an employee leaves but their SaaS access, licence, or OAuth-connected app remains active outside the IdP.
- Privilege persists through standing access in unsanctioned or partially integrated applications that offboarding never touches.
- Impact follows as former users can still access data, organisations keep paying for dormant licences, and compliance evidence remains incomplete.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
- Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Incomplete offboarding is a lifecycle failure, not an access failure. Revocation alone only proves that one access path was removed. If licences, data handoff, and downstream app state are still unresolved, the identity has not actually been retired. Practitioner teams need to think in terms of closure, not just deprovisioning.
Shadow IT turns SaaS offboarding into a discovery discipline. Organisations cannot govern what they do not inventory, and the article shows that unsanctioned apps persist long enough to drain budget and preserve access. That makes continuous SaaS discovery a prerequisite for any credible leaver process.
Access review and offboarding are different controls with different failure modes. Offboarding removes a departing user, while access review tests whether current entitlements are still justified. The fact that the article calls out both is the signal: organisations that rely on a single leaver event will miss standing access that should never have existed in the first place.
Licence reclamation is now part of identity governance economics. The business case is not only about reducing risk, but about preventing orphaned spend from becoming normalised operating waste. That changes SaaS governance from a support function into a measurable control domain with budget, compliance, and audit consequences.
Offboarding exposes the boundary between IdP control and application control. Identity providers can close federated sessions, but they cannot by themselves guarantee account deletion, licence recovery, or data transfer inside every SaaS tenant. The control boundary therefore sits across the identity layer and the application lifecycle, and practitioners must govern both.
From our research library:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- Around 59% of companies report experiencing a data breach related to poorly managed offboarding processes.
- Read next: NHI Lifecycle Management Guide
What this signals
Licence recovery is the missing control in many leaver processes. Organisations often stop at access removal, but the deeper failure is that billable SaaS seats and app ownership remain live after the employee is gone. That creates a recurring governance debt that shows up first as wasted spend and later as audit friction.
Offboarding has become a discovery problem, not just a revocation problem. When workers can use shadow IT and OAuth-connected apps outside the IdP, the programme has to find the apps before it can close them. Continuous inventory is the control that separates a believable offboarding process from a partial one.
For practitioners
- Define offboarding as full lifecycle closure Require account deletion, licence reclamation, data transfer, and audit evidence in the same leaver workflow rather than treating revocation as completion.
- Build a continuous SaaS discovery feed Reconcile approved applications, shadow IT, OAuth grants, and business-system integrations so offboarding can see the full estate before turnover happens.
- Separate access revocation from licence recovery Track whether each downstream app removes the account, returns the seat, or only blocks login, and close the gap where the licence remains billable.
- Add offboarding evidence to audit packs Keep exportable records of every leaver decision, licence change, and asset transfer so compliance teams can prove closure after each departure.
- Review non-SSO apps before departure Check the apps outside SSO first, because they are the ones most likely to keep stale access and orphaned spend alive.
Key takeaways
- Incomplete SaaS offboarding leaves organisations with active access paths, orphaned licences, and weak audit evidence after employees depart.
- The article ties that gap to real-world scale, including 38% of employees who have accessed a prior employer’s accounts after leaving and more than a quarter-million dollars in annual incident costs tied to unsanctioned SaaS.
- The practical fix is lifecycle closure across discovery, account deletion, licence recovery, and data transfer, not just revocation through the IdP.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centres on leavers who keep access, licences, or ownership after departure. |
| NHI-03 — Vulnerable Third-Party NHI | Unsanctioned and third-party SaaS apps create offboarding gaps outside direct IT control. | |
| NHI-09 — NHI Reuse | Reclaimed licences and reassigned accounts are a governance issue when identities persist across workers. | |
| Recommendation — Map SaaS leaver workflows to NHI-01 and verify that accounts, licences, and assets are fully closed. Inventory third-party SaaS dependencies and revoke access paths that offboarding currently misses. Prevent identity reuse without explicit closure by separating account retirement from seat reassignment. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing entitlements across the full SaaS lifecycle, not only login access. |
| Recommendation — Apply PR.AA-05 to validate that SaaS entitlements are removed, not merely disabled, at offboarding. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle control is central to preventing residual SaaS access after departure. |
| Recommendation — Use CIS-5 to ensure departing users lose all application accounts and related privileges. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Residual SaaS access can be abused for further access and movement after offboarding fails. |
| Recommendation — Map stale SaaS access to TA0006 and TA0008 so detection focuses on credential retention and follow-on abuse. | ||
Key terms
- SaaS offboarding: The process of removing a departing user from software access while also closing the related account, subscription, and data-handling obligations. In mature programmes, it includes license recovery, file transfer, inbox ownership changes, and evidence that the app lifecycle has ended cleanly.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- Licence Reclamation: Licence reclamation is the removal or downgrade of software entitlements that are no longer justified by usage. In identity governance terms, it is a lifecycle action based on observed need, and it becomes more effective when usage telemetry is reliable enough to trigger automated review or deprovisioning.
- Lifecycle Closure: Lifecycle closure is the discipline of making sure access does not only get granted and adjusted, but also removed when the business need ends. In identity governance, it means provisioning, change, review, and revocation are treated as one control loop rather than separate tasks.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or IAM programme maturity, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org