Notifications
Clear all
Topic starter
11/06/2026 11:24 pm
TL;DR: Offboarding gaps leave SaaS access behind after employees depart, and Zluri cites a Gartner-backed study showing only 14% of surveyed companies have systems and processes for SaaS deprovisioning. The real control failure is not removal intent but incomplete revocation across SSO, sessions, app-level entitlements, and shadow IT.
NHIMG editorial — based on content published by Zluri: Automation 4 Ways of Revoking Access to Tools While Offboarding Employees
By the numbers:
- Only 14% of the companies surveyed have systems and processes around SaaS deprovisioning while offboarding.
- 15 days even after access is revoked., or a full 15 days even after access is revoked.
Questions worth separating out
Q: How should security teams handle SaaS access during employee offboarding?
A: Security teams should revoke access across the IdP, application layer, and active sessions, then confirm that no remaining permission paths exist.
Q: Why do SSO-based offboarding processes sometimes leave access behind?
A: SSO revocation removes one authentication path, but it does not always terminate existing SaaS sessions or remove app-specific entitlements.
Q: What breaks when SaaS inventories are maintained in spreadsheets?
A: Spreadsheets go stale quickly and cannot discover shadow IT, so the offboarding team ends up revoking access to only the known applications.
Practitioner guidance
- Map every SaaS access path before deprovisioning Build a leaver checklist that includes SSO, direct app logins, device sessions, delegated access, and unmanaged tools so revocation does not stop at the IdP layer.
- Invalidate active sessions as a required exit step Require application-side session termination for critical SaaS tools, especially where token lifetime can outlast the employee's departure or the IdP disablement event.
- Replace spreadsheet inventories with continuous app discovery Use live discovery to keep the SaaS inventory current, because manual tracking cannot keep pace with shadow IT or fast-changing application adoption.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- The four revocation approaches the vendor describes, including spreadsheet tracking, SSO-based removal, SaaS management automation, and self-serve workflow approvals.
- The step-by-step offboarding sequence the vendor outlines for removing authentication, moving data, deleting the user, and removing SSO access.
- The vendor's discussion of Slack session persistence and why SSO deprovisioning alone can leave an access window open.
- The workflow claims around visibility into sign-in logs, audit logs, and app permissions that underpin automated offboarding.
👉 Read Zluri's article on four ways to revoke SaaS access during offboarding →
SaaS offboarding and access revocation: where do teams break down?
Explore further
12/06/2026 8:03 am
Offboarding failure is a lifecycle problem, not a point-in-time access problem. The article shows that revocation can be technically correct at the identity provider and still incomplete at the application layer. That is the core governance failure in human identity lifecycle management: access can outlive the event that should have ended it. Practitioners should treat leaver processing as a full entitlement closure workflow, not an account disablement task.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when a former employee still has access after offboarding?
A: Accountability usually sits with IAM, IT, and application owners together, because offboarding failure is a cross-system governance issue. Directory admins may disable the account, but SaaS owners must also invalidate sessions and remove app access. Frameworks such as the NIST Cybersecurity Framework 2.0 support that shared control ownership.
👉 Read our full editorial: SaaS offboarding exposes the access revocation gap teams miss
