What breaks when offboarding only disables the primary account?

Why This Matters for Security Teams

Disabling only the primary account leaves the offboarding event incomplete because access is rarely concentrated in one place. service account, OAuth grants, API keys, application sessions, and delegated permissions can continue to operate after HR records show termination. That gap turns offboarding into an administrative checkbox rather than an access-control action, which is exactly how residual privilege survives in production.

NHI Management Group has documented how lifecycle gaps persist when organisations do not treat revocation as a multi-system process in the NHI Lifecycle Management Guide and the Top 10 NHI Issues. The same pattern appears in human offboarding when connected access is not fully unwound, and the operational impact is the same: hidden paths remain open long after the primary login is disabled. Current guidance from NIST Cybersecurity Framework 2.0 treats access management as an ongoing control, not a one-time event. In practice, many security teams discover the remaining access only after a sensitive system is accessed from a token that nobody expected to survive termination.

How It Works in Practice

Proper offboarding should be designed as a revocation workflow across identity, application, and infrastructure layers. Disabling the directory account is only one step. Security teams also need to invalidate active sessions, remove group membership, revoke OAuth consents, rotate or retire API keys, disable linked service accounts, and confirm that downstream systems no longer trust the terminated identity.

A practical sequence usually includes:

• Terminate the primary human account in the IdP or directory service.
• Revoke refresh tokens, API tokens, and third-party application grants.
• Kill active sessions and device-based trust where supported.
• Remove access from PAM, cloud roles, CI/CD, and shared admin tooling.
• Rotate shared secrets if the departing user could have seen or used them.
• Verify completion through logging, not just workflow status.

This matters because access often persists outside the account itself. The Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs shows why lifecycle control must include creation, rotation, monitoring, and decommissioning, not just the initial login. For identity governance, NIST guidance is consistent with this view: access should be continuously managed, reviewed, and removed when no longer required. Best practice is to make offboarding event-driven and evidence-based so that each connected system must confirm revocation before closure is recorded. These controls tend to break down in SaaS-heavy environments because disconnected admin consoles, stale app consents, and shadow integrations are not governed by the same control plane.

Common Variations and Edge Cases

Tighter offboarding often increases operational overhead, requiring organisations to balance fast termination against complete revocation. That tradeoff is real, especially in federated SaaS estates where every application handles tokens, sessions, and delegated access differently.

There is no universal standard for exact revocation timing, but current guidance suggests that high-risk roles should trigger immediate token invalidation and post-termination verification. Delays are especially risky when shared mailboxes, cloud admin roles, or automation accounts are tied to the user, because the primary account may disappear while the effective control path remains intact. The same issue can affect contractors and privileged vendors, where access is granted through multiple sponsor workflows rather than a single joiner-mover-leaver record.

One useful test is simple: if the security team cannot prove that every linked credential, session, and downstream permission is gone, then offboarding is not complete. That is why termination handling should be measured against revocation evidence, not just HR closure. In environments with lots of unmanaged apps or manual exceptions, this guidance degrades quickly because the organisation cannot reliably enumerate every place where the former account is still trusted.

Related resources from NHI Mgmt Group

• When does a service account become a compliance problem?
• What breaks when offboarding is only checked in the primary directory?
• What breaks when user account offboarding is not automated?
• What breaks when cloud access tools cannot see all delegated identities?