Topic starter
27/06/2026 1:36 pm
TL;DR: Disabling an IdP account does not reliably revoke OAuth grants, API tokens, or cached SaaS sessions, and in Microsoft 365 without Continuous Access Evaluation, refresh tokens can stay valid for days after disablement, according to Abnormal AI. The governance gap is not account shutdown but phantom access that survives offboarding and escapes normal detection.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “What Stays Logged In After an Employee Leaves”.
By the numbers:
- In Microsoft 365 without Continuous Access Evaluation, refresh tokens can survive for days after an account is disabled.
Key questions
Q: What breaks when an IdP account is disabled but OAuth grants still remain active?
A: The assumption that account disablement equals access removal breaks down.
Q: Why do offboarding failures create security risk even when accounts are eventually removed?
A: Because delayed revocation creates a window where access remains valid after the business need has ended.
Q: How can security teams detect phantom access after a user leaves?
A: By continuing to baseline and monitor the disabled identity instead of stopping at status change.
Practitioner guidance
- Inventory every downstream grant created by the identity Build an offboarding inventory that includes OAuth grants, API tokens, delegated access, cached sessions, and unmanaged device sessions, then reconcile each item against the account disable event.
- Verify revocation in each relying application Confirm that every SaaS application receiving federated access can actually process revocation, and document where tokens remain valid after directory disablement.
- Keep behavioural monitoring active after offboarding Continue watching disabled identities for activity that deviates from the pre-offboarding baseline, including new geographies, unusual delegate usage, and API calls from stale credentials.
Bottom line: Disabling an IdP account does not necessarily terminate the access paths that matter most in SaaS environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:59 pm
Offboarding gap is the wrong label for a control boundary problem: this issue is not that leaver processing failed at the HR or IdP step, but that downstream authorisation state survived where the IdP had no direct control. OAuth grants, refresh tokens, and cached sessions live in different trust stores, so deactivation is only partial unless each relying system receives and enforces revocation. The practitioner conclusion is that offboarding must be modelled as distributed access removal, not directory cleanup.
A few things that frame the scale:
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to the State of Secrets Sprawl 2026.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise token revocation or account disablement first?
A: Account disablement is necessary to stop interactive access, but revocation of OAuth grants, API tokens, and sessions is what closes the residual access window. If you have to sequence the work, disable the account to contain the user, then verify revocation in every application that can keep the credential alive.
👉 Read our full editorial: Offboarding gaps leave OAuth grants alive after IdP disablement