Employee offboarding can disable a login without fully killing access, leaving OAuth grants, API tokens, cached SaaS sessions and delegated permissions active after a worker leaves.
Abnormal Security laid out the problem in a Wednesday post. The core issue is that identity provider disablement, SCIM deprovisioning and SSO controls usually stop front-door authentication. They do not always revoke every token, session, mobile app grant, browser session or API key that was already issued.
That issue follows a larger trend where attackers increasingly target tokens rather than passwords. A disabled account may still have cached access from an unmanaged device, a long-lived SaaS session, delegated mailbox access or an app grant approved before termination. Abnormal also warned that some detection systems stop watching identity behavior once an account is disabled, creating a blind spot precisely when access should be most scrutinized.
The U.S. Cybersecurity and Infrastructure Security Agency’s Secure Cloud Business Applications guidance warns that OAuth access can outlive a terminated user. The problem persists in practice: more than 30 percent of organizations take longer than three days to fully revoke access after an employee leaves, with some never completing the process, according to offboarding research compiled by vendors tracking the issue.
Microsoft’s Continuous Access Evaluation is one control designed to narrow that gap. Microsoft says CAE can enforce events such as user termination, password changes and session revocation near real time across supported services including Exchange, SharePoint and Teams. Microsoft’s own token documentation also notes that refresh tokens can be used to acquire new access tokens for resources where the client has permission.
Abnormal suggests offboarding should include token revocation, OAuth grant review, API key cleanup, mailbox delegation checks, session invalidation and post-disable monitoring for unusual API, geography or device activity.
