Most offboarding checklists were written for HR, not security. They cover the badge, the laptop, the final paycheck, and one line item that says "disable account in Entra ID / Okta." That line item is where most orphaned access actually starts.
Disabling the identity provider account stops new sign-ins through SSO. It does not revoke standing sessions, personal access tokens, OAuth grants to third-party apps, or access in tools that were never wired into SSO in the first place. Here is the checklist that actually closes those gaps.
1. Kill active sessions, not just the account
A disabled identity provider account does not terminate sessions that are already live. Slack, Google Workspace and most SaaS tools cache auth for hours or days. If you only disable the account, a departing employee can keep working in an open tab until the session naturally expires.
2. Audit OAuth grants and personal access tokens separately
Every "Sign in with Google" or "Authorize this app" click creates a standing grant that survives account deactivation in the connected tool. Personal access tokens for GitHub, GitLab, or internal APIs are worse: they are often created outside any central inventory and never expire unless someone manually revokes them.
3. Don't assume SSO covers everything
In most mid-size companies, 20-40% of the SaaS tools in active use were never provisioned through the identity provider. Marketing signed up for a tool with a personal card, an engineer invited a teammate directly to a repo, someone set up a shared Notion workspace. None of that shows up when you disable the SSO account.
4. Log every revoke with a timestamp and actor
If you are preparing for a SOC 2 or ISO 27001 audit (or now NIS2), "we disabled the account" is not evidence. Auditors want to see when access was revoked relative to the termination date, in which systems, and who confirmed it.
The actual checklist
- Disable the identity provider account (Entra ID, Okta, Google Workspace, etc.)
- Force-terminate active sessions across every connected app, not just the IdP
- Revoke OAuth grants and API/personal access tokens tied to the departing user
- Check for tools outside SSO scope: chat, dev tools, shared drives, ticketing systems
- Reassign or transfer ownership of any resources (repos, docs, automations) the user owned
- Log the full revoke trail with timestamps for audit evidence
Doing this manually, per employee, across every tool your company runs does not scale past a handful of offboardings a month. That is the exact gap AccessRevoke was built to close: a self-hosted agent that runs this checklist automatically the moment your HR system flags a leaver, across whichever apps your company actually uses.