Because those access paths do not depend on the SSO session. A user can be blocked in SSO and still authenticate through a local password, a preexisting token, or an OAuth grant. This creates a false sense of closure. Security teams need discovery and revocation beyond the identity provider to reduce residual access and exposure.
Why This Matters for Security Teams
Offboarding risk rises when access is not anchored to a single control point. SSO is only one path into an application, so disabling the IdP session does not automatically invalidate local passwords, long-lived bearer tokens, or pre-consented OAuth grants. That leaves residual access behind after a termination, role change, or contractor exit, even when the identity provider shows the user as blocked.
Current guidance from NIST Cybersecurity Framework 2.0 and NHIMG research both point to the same operational problem: identity governance fails when teams assume the directory is the full control plane. NHIMG’s NHI Lifecycle Management Guide treats lifecycle closure as a discovery and revocation problem, not just a deprovisioning task. That distinction matters because tokens and grants often outlive the login session that created them.
In practice, many security teams discover this only after an audit, an incident review, or a post-termination access check has already exposed active sessions and tokens that were never tied back to SSO.
How It Works in Practice
SSO reduces the number of credentials a person must remember, but it does not eliminate every authentication path. A typical application can still accept a local username and password, refresh token, personal access token, API key, or OAuth grant issued earlier through an app consent flow. Once issued, those artifacts often operate independently of the IdP session that originally enabled them.
That is why offboarding has to include application-side inventory and revocation. Security teams need to identify where the user can authenticate directly, where delegated access has been approved, and which tokens can still refresh without user interaction. The practical sequence is usually: discover accounts and grants, disable interactive login, revoke active tokens, invalidate refresh tokens where supported, and confirm that the app will not silently reissue access. The NIST SP 800-53 Rev 5 Security and Privacy Controls support this by emphasizing access revocation, account management, and continuous control monitoring.
OAuth creates especially tricky residual risk because the grant may belong to the application, not just the human. A user can be removed from SSO and still leave behind a valid consented connection to SaaS data, mailboxes, chat tools, or developer platforms. NHIMG documented this pattern in the Salesloft OAuth token breach, where stolen OAuth tokens bypassed the expectation that identity-provider enforcement alone would contain the exposure. The right response is to treat offboarding as full credential and grant retirement, not just account disablement.
These controls tend to break down when shadow IT apps, service-to-service integrations, or legacy SaaS platforms do not expose complete revocation APIs, because security teams cannot prove that every direct login path and token has been removed.
Common Variations and Edge Cases
Tighter offboarding often increases operational overhead, requiring organisations to balance rapid termination with verification that no alternate access path remains. That tradeoff becomes sharper when applications support multiple login methods or when consent is granted at the workspace, tenant, or organization level rather than per user.
- Some apps keep refresh tokens valid after password resets, so credential changes do not equal revocation.
- Shared or overused accounts can keep working even after the named user is removed from SSO.
- Service accounts and delegated admin grants may persist long after the employee who created them has left.
- Enterprise apps can expose inconsistent logout behaviour across browser sessions, mobile clients, and API access.
There is no universal standard for this yet, but best practice is evolving toward continuous discovery of direct-auth accounts and periodic revalidation of OAuth grants. NHIMG’s Top 10 NHI Issues and the Guide to the Secret Sprawl Challenge both reinforce the broader pattern: access persists when credentials and grants are allowed to sprawl beyond the lifecycle controls of the directory. In that environment, offboarding must be verified against the application itself, not inferred from SSO status alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Direct login and token sprawl are core NHI lifecycle and revocation risks. |
| OWASP Agentic AI Top 10 | Runtime grants and delegated access reflect dynamic authorization risk patterns. | |
| CSA MAESTRO | Agentic and delegated access requires lifecycle control beyond the IdP. | |
| NIST CSF 2.0 | PR.AC-4 | Access revocation and least privilege are central to safe offboarding. |
| NIST SP 800-63 | Session and authenticator management matter when tokens outlive login state. |
Treat tokens and authenticators as separate credentials that need explicit invalidation.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
