---
title: "How to revoke access when an employee leaves"
canonical: https://harmony.io/insights/revoke-access-when-employee-leaves
---

# How to revoke access when an employee leaves

_Ran Ribenzaft · 2026-10-18_

_Data verified October 2026 · Reviewed by Ran Ribenzaft, Co-Founder & CTO._

**Categories:** SSO / Identity, Automation

Revoke a leaver's access in the right order: disable the identity account, kill sessions and tokens, then clean up apps outside SSO, shared secrets, devices and ownership. Steps for Entra ID, Okta, Google Workspace and GitHub.

To revoke access when an employee leaves, disable their account in your identity provider at the agreed time, then immediately revoke their active sessions and refresh tokens, because disabling an account does not log out a browser or app that is already signed in. Next, remove the access that does not run through single sign-on: local accounts in SaaS apps, API keys and personal access tokens, shared passwords, VPN and building access. Finally, lock or recover their devices, transfer the files and responsibilities they owned, and record what was done. CIS Controls Safeguard 6.2 asks for a process, preferably automated, that disables accounts immediately upon termination, and recommends disabling rather than deleting accounts so audit trails are preserved.

## Before the last day: agree the time and the list

Most access gaps come from not knowing who is leaving, or when. Two things need to be settled before the day:

- **The trigger.** The departure should reach IT from the HRIS, not from a forwarded email. Agree whether access ends at a set time on the last day, or immediately for involuntary departures.
- **The access inventory.** List everything the person can reach: identity provider groups, SSO applications, applications outside SSO, admin roles, cloud consoles, code repositories, shared vaults, VPN, badges and devices. If you cannot produce this list in minutes, that is the first thing to fix, because a revocation checklist is only as complete as the inventory behind it.

## Step 1: Disable the identity account

Disable, do not delete. A disabled account blocks sign-in and keeps the user's data, group history and audit trail for investigation and transfer.

| Identity provider | What to do | What to know |
| --- | --- | --- |
| Microsoft Entra ID | Set the account to disabled (Update-MgUser with AccountEnabled set to false), or block sign-in in the Microsoft 365 admin center | Microsoft notes blocking an account can take up to 24 hours to take effect, and recommends also resetting the password to stop sign-in immediately |
| Okta | Deactivate the user, rather than suspend | Deactivation ends all Okta sessions, removes application assignments and admin roles. Suspension keeps app assignments, so the user can keep access to downstream apps |
| Google Workspace | Suspend the user, then reset the password and sign-in cookies | Suspension blocks access and keeps data, but suspended accounts are still charged |

## Step 2: Revoke sessions and tokens

Disabling the account stops new sign-ins. It does not end sessions that already exist, which is how a departed employee can stay logged in to email on a phone or to a SaaS app in a browser tab.

- **Entra ID:** revoke refresh tokens and session cookies with Revoke-MgUserSignInSession (Microsoft Graph revokeSignInSessions). Access tokens already issued stay valid for up to an hour by default, and Entra cannot revoke a session token that an application issued itself, so apps with their own sessions need step 3. Continuous Access Evaluation shortens the gap in apps that support it.
- **Okta:** use Clear User Sessions and choose to revoke tokens as well, which signs the user out of Okta on all devices and browsers. Sessions inside downstream applications may persist until they expire.
- **Google Workspace:** resetting the user's sign-in cookies signs them out of all sessions, revokes app-specific passwords and stops third-party mail apps from syncing.
- **Devices registered to the user:** in Entra ID, disable the user's registered devices as part of the same step.

## Step 3: Remove access that does not run through SSO

This is where most leftover access lives.

1. **Applications outside SSO.** Every app with a local username and password needs the account removed or disabled inside the app. Check which apps are connected to your identity provider with provisioning (SCIM) turned on; Okta, for example, only deprovisions apps where deprovisioning is enabled. Everything else is manual.
2. **Code and infrastructure.** Remove the person from your GitHub organization; removed members lose access to private forks of the organization's private repositories, though local clones stay on their machine. With SAML SSO, also revoke their authorized personal access tokens and SSH keys. Rotate any cloud access keys and service account credentials they created or held.
3. **Shared secrets.** Rotate passwords for shared accounts they knew, such as social media, vendor portals and Wi-Fi, and remove them from shared password manager vaults.
4. **Network and physical access.** Remove VPN certificates or accounts, and deactivate badges.
5. **Email.** Decide on forwarding, auto-reply and mailbox delegation to the manager, then convert or retain the mailbox under your retention policy.

## Step 4: Lock or recover devices

Company laptops and phones hold local copies of data that account revocation does not touch. Microsoft points out that a device wipe only runs when the device is online, and an offline device keeps whatever is stored locally. Lock the device through MDM if it is not coming back immediately, and plan the return. See [how to get laptops back from departing employees](https://harmony.io/insights/recover-laptops-from-departing-employees).

## Step 5: Transfer what they owned

Revocation takes things away. The other half is the responsibilities that lose an owner: files and shared drives, application ownership, open tickets, pending approvals, calendars, and on-call rotations. In Google Workspace, Drive files and the primary calendar can be transferred when the user is deleted, and a deleted account can be restored for up to 20 days. Reassign ownership before you delete anything.

## Step 6: Verify and record

Check sign-in logs a day later for any successful sign-in by the disabled account, confirm application owners removed local accounts, and store the completed checklist with the ticket. That record is what auditors ask for under SOC 2 and ISO 27001 and what NIST SP 800-53 control PS-4 describes: disable system access within a defined time, revoke authenticators and credentials, and retrieve organizational property.

## Timing: how fast is fast enough

Set the target in your policy and measure against it. For involuntary departures, access should end at or before the conversation. For planned departures, a fixed time on the last day works, provided sessions are revoked at the same moment. The weak point is rarely the identity provider; it is the long tail of applications and secrets in step 3, which is why revocation tends to slip from hours to weeks when it is done by hand.

## Automating revocation

The reliable version of this process starts from the HRIS. When a termination date is set, the work should create itself:

- [Employee Offboarding](https://harmony.io/agents/employee-offboarding) in Harmony is triggered by the departure in the HRIS, gathers the employee's profile and access inventory, routes approvals, deactivates accounts across identity systems, terminates active sessions, and opens linked tickets for equipment return, data archiving, VPN removal, physical access and the HR steps, then notifies the manager when everything is done.
- [Employee Account Termination](https://harmony.io/agents/employee-account-termination) covers urgent cases: an admin or manager requests it in Slack or Teams, approval is routed, and Harmony deactivates the accounts across every configured identity provider and terminates sessions, with the whole sequence in a high-priority ticket.
- [Offboarding Ownership Transfer Report](https://harmony.io/agents/offboarding-ownership-transfer) runs two weeks before the end date by default and lists the applications, tickets, approvals, desks and agents the person owns, so they can be reassigned before the last day.
- [Inactive Employees](https://harmony.io/agents/inactive-employees) catches what slipped through: accounts with no sign-in beyond a threshold, and the devices still assigned to them.

For the wider offboarding process and the tools that run it, see [employee offboarding software](https://harmony.io/insights/employee-offboarding-software) and [which HRIS automates onboarding and offboarding](https://harmony.io/insights/automate-employee-onboarding-offboarding).

## Frequently asked questions

### What is the first thing IT should do when an employee leaves?

Disable the account in the identity provider and, in the same step, revoke the user's active sessions and refresh tokens. Disabling alone does not sign out sessions that are already open.

### Should you delete or disable a departed employee's account?

Disable it first. CIS Controls Safeguard 6.2 notes that disabling instead of deleting may be necessary to preserve audit trails, and it gives you time to transfer files and ownership. Delete later under your retention policy.

### Does disabling an Entra ID or Okta account log the user out everywhere?

Not on its own. In Entra ID, revoke sign-in sessions as well; access tokens can remain valid for up to an hour. In Okta, deactivation ends Okta sessions, but sessions inside downstream applications may last until they expire.

### What access is most often missed when someone leaves?

Applications that are not connected to single sign-on, personal access tokens and SSH keys, cloud access keys, shared account passwords, and ownership of files, applications and approvals.

### How quickly should access be revoked?

Immediately upon termination, per CIS Safeguard 6.2. In practice, at a set time on the last day for planned departures, and at or before the conversation for involuntary ones.

### Can offboarding access removal be automated?

Yes. Triggering offboarding from the HRIS lets a platform such as Harmony deactivate accounts, end sessions and open the remaining tasks automatically, with approvals and an audit record.

## Sources

1. [Revoke user access in an emergency in Microsoft Entra ID (Microsoft Learn), accessed October 18, 2026](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access)
2. [user: revokeSignInSessions (Microsoft Learn), accessed October 18, 2026](https://learn.microsoft.com/en-us/graph/api/user-revokesigninsessions?view=graph-rest-1.0)
3. [Prevent user sign-in and block access to Microsoft 365 (Microsoft Learn), accessed October 18, 2026](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-1?view=o365-worldwide)
4. [Deactivate and delete user accounts (Okta), accessed October 18, 2026](https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-deactivate-user-account.htm)
5. [Differences between deactivated and suspended user states (Okta), accessed October 18, 2026](https://support.okta.com/help/s/article/differences-between-deactivated-and-suspended-user-states-in-okta)
6. [Revoke all user sessions (Okta), accessed October 18, 2026](https://help.okta.com/en-us/content/topics/security/slo/session-revoke.htm)
7. [Reset a user's password (Google Workspace Admin Help), accessed October 18, 2026](https://knowledge.workspace.google.com/admin/users/reset-a-users-password)
8. [Suspend a user temporarily (Google Workspace Admin Help), accessed October 18, 2026](https://knowledge.workspace.google.com/admin/users/suspend-a-user-temporarily)
9. [Delete or remove a user from your organization (Google Workspace Admin Help), accessed October 18, 2026](https://knowledge.workspace.google.com/admin/users/delete-or-remove-a-user-from-your-organization)
10. [Removing a member from your organization (GitHub Docs), accessed October 18, 2026](https://docs.github.com/en/organizations/managing-membership-in-your-organization/removing-a-member-from-your-organization)
11. [Viewing and managing a member's SAML access (GitHub Docs), accessed October 18, 2026](https://docs.github.com/en/enterprise-cloud@latest/organizations/granting-access-to-your-organization-with-saml-single-sign-on/viewing-and-managing-a-members-saml-access-to-your-organization)
12. [6.2 Establish an Access Revoking Process (CIS Controls Assessment Specification), accessed October 18, 2026](https://controls-assessment-specification.readthedocs.io/en/latest/control-6/control-6.2.html)
13. [Personnel Security controls (NIST SP 800-53 PS-4) (FedRAMP), accessed October 18, 2026](https://fedramp.gov/2026/reference/controls/personnel-security/)

_Microsoft Entra ID, Microsoft 365 and Intune are trademarks of Microsoft Corporation. Okta is a trademark of Okta, Inc. Google Workspace is a trademark of Google LLC. GitHub is a trademark of GitHub, Inc. Harmony is not affiliated with these companies._