What should teams do first when an employee leaves in a hybrid identity environment?

What comes first in a leaver process for hybrid identity?

The first control point is the primary directory, because it is the source from which most downstream access is federated, synchronised, or re-issued. If that account stays active, the user can often still reach cloud apps, VPNs, admin portals, and password recovery paths even after local IT changes. Immediate disablement cuts off the highest-value path before residual access is cleaned up.

That first step should be treated as an access containment move, not a final offboarding action. In hybrid environments, the directory account, federation relationships, cached sessions, and linked recovery options can all keep a departed user alive unless the primary identity is disabled before anything else.

NHIMG’s Joiner-Mover-Leaver (JML) Guide is the right starting point for sequencing leaver controls across the full identity lifecycle.

Which access paths must be revoked immediately after disablement?

Once the primary directory sign-in is blocked, the next task is to revoke every active path that could still authenticate or authorize the former employee. That includes SaaS sessions, VPN access, privileged roles, federation trust, recovery methods, and any delegated or shared credentials that were issued outside the main directory workflow. The aim is to remove both direct logon and any alternate route back in.

In a hybrid estate, the residual-risk problem is usually not one account, but many linked access surfaces. A user may be cut off from the directory but still hold a valid browser session, a long-lived token, a local admin path, or a recovery channel that can re-establish access without raising an obvious alert.

Use Multi-Cloud Identity Guide for the broader privilege-governance pattern, and Workforce Identity Security Guide for the employee-access paths that often survive a simple account disable.

What cleanup prevents residual access after the employee has left?

After access is cut, teams should finish the job by resetting shared secrets, reviewing group membership and app assignments, and checking device enrolment. Those are the places where stale privilege often survives a clean-looking offboarding record. If a departing employee was tied to shared credentials, local device trust, or inherited application roles, those dependencies can still expose systems even when the main account is disabled.

This final sweep matters because hybrid identity often spans more than one authority boundary. A clean primary-directory shutdown does not automatically remove access from synchronised groups, federation-linked apps, MDM-enrolled devices, or service paths that were granted indirectly.

Risk and Threat Considerations

The main risk is time-to-removal. Every minute between employment termination and full access revocation gives the former user an opportunity to use existing sessions, cached tokens, privileged roles, or recovery channels. In a hybrid identity setup, that window is especially dangerous because access can persist through more than one system of record.

Failure mechanism: The directory account is disabled, but downstream services still trust an active session, federation assertion, cached credential, shared secret, or device enrolment. The identity looks closed from one console while it remains usable from another.

Impact: The organisation can be exposed to data access, privilege misuse, mailbox or SaaS abuse, and delayed detection of an insider or compromised former account. The longer the cleanup is deferred, the more likely it becomes that access persists somewhere unexpected.

Practitioner Guidance

What to prioritise: Treat the primary directory disablement as the containment action and make it the first recorded step in the leaver workflow. Then verify that the user cannot still authenticate through federation, active sessions, VPN, or privileged role inheritance.

What to verify: Confirm that shared secrets, group memberships, app assignments, and device trust have been removed or reset, and that the account cannot be reactivated through a secondary identity path.

Practitioner takeaway: The safest offboarding sequence is containment first, cleanup second, because hybrid identity failures usually come from the access paths teams forgot were still live.

Related resources from NHI Mgmt Group

• Guide: Active Directory and Entra ID Hardening Guide
• Hybrid Identity Environment
• Which identity controls should be reviewed first in an AD-heavy environment?
• How should security teams implement identity-first microsegmentation in hybrid environments?
• What breaks when identity tools only cover one side of a hybrid environment?