When someone leaves, disable their single sign-on account first, then deal with what SSO does not reach: local logins, API keys, OAuth grants they created, shared files they own and tools they administer. Transfer ownership before deleting anything, and record each step for audit.
Before the last day
- Ask the manager for a list of tools the person uses and owns.
- Identify anything where they are the only administrator or contact.
- Plan transfers for shared documents, calendars, and recurring reports.
On the last day
- Disable the primary account in your identity provider. This cuts off every app that uses SSO.
- Revoke sessions and tokens. Disabling an account does not always end existing sessions or refresh tokens, so check how your platform handles it.
- Reset or remove MFA devices registered to that person.
- Collect hardware and remove device enrollments.
The apps SSO does not cover
Work through the SaaS inventory and mark each app that has a local login. For each:
- Remove the user, or change the owner and then remove them.
- Rotate shared passwords the person knew.
- Remove them from billing and security notification contacts.
Tokens and connections they created
People create API keys, personal access tokens and OAuth connections. These can keep working after the user is disabled, depending on the platform. List and remove:
- API keys in their name
- Webhooks and integrations they set up
- OAuth grants for third-party apps
- Deploy keys and personal tokens in code hosting
Microsoft documents how to review and revoke application permissions in Entra, which is useful when the leaver granted access to an app. See the walkthrough.
Data and ownership
Transfer ownership of documents, shared drives, dashboards and repositories. Deleting an account too early can delete data that others rely on. Set a retention period, then delete according to policy.
Mail and forwarding
Set up a temporary mailbox delegate for the manager if business mail is needed, and check for auto-forward rules to personal addresses.
Afterward
- Review sign-in logs for the previous 30 days for unusual activity, and for any attempts after the account was disabled.
- Close the ticket with evidence: who did what and when.
- Note any app you found that was not in the inventory and add it.
Make it repeatable
Use the same checklist each time and tie it to your HR system, so the process starts when the departure is recorded, not when someone remembers.
For privileged staff such as administrators, treat departure as higher risk. Rotate any shared secrets and recovery codes they held, and review admin audit logs for changes made in their final weeks.
Where Safeguard fits
Safeguard supports compliance and evidence automation that can help you keep records of access reviews. It does not remove access in your SaaS tools for you.
Quick check
Is disabling the SSO account enough?
No. Local accounts, API keys, tokens and OAuth grants can survive it, so work through your app inventory.
Sources
Last reviewed: 19 October 2026.
