Daniel, a systems engineer with administrative access, is being dismissed this afternoon. HR asks that his access end at the moment the meeting starts, at 15:00. A normal overnight offboarding job is not enough.
This example applies joiner, mover, leaver and sessions, tokens, and revocation under time pressure.
Prepare before 15:00
Without alerting Daniel, the IAM and security teams build an inventory:
- Central directory and identity provider accounts.
- A separate administrative account, and any privileged role eligibility.
- Applications outside SSO with local accounts.
- Personal access tokens, API keys, and SSH keys he created.
- Service accounts or automation he owns or knows the credentials for.
- Shared secrets in vaults he could read.
- Devices: laptop, phone with company data, hardware security keys.
The inventory comes from the identity model, not from memory. Gaps found here are lessons for the regular process.
Execute at 15:00
The order matters: stop new access, then end existing access, then remove standing paths.
- Disable the central account and administrative account in the identity provider and directory.
- Revoke refresh tokens and terminate identity provider sessions.
- Terminate sessions in critical applications that do not re-check the identity provider.
- Remove privileged role eligibility and active elevations.
- Revoke personal access tokens, API keys, and SSH keys.
- Disable local accounts in non-federated applications.
- Wipe or lock company data on mobile devices and disable the laptop’s access.
Handle what he knew
Daniel may know shared credentials: a service account password, a break-glass procedure, or a network device’s local admin password. Rotate each one. This is why shared credentials are costly, and why vaulting and just-in-time access reduce the work.
Transfer ownership of his service accounts, scheduled jobs, and applications to his team, so nothing breaks silently when his account is disabled.
Verify and record
Do not rely on “the workflow completed”. Check:
- A sign-in attempt with his account fails.
- Recent sign-in logs show no activity after 15:00.
- Each high-risk application shows the account as disabled.
- Tokens and keys listed in the inventory no longer work.
Record times for each step. This evidence shows auditors that the termination was effective and reveals which steps were slow.
Afterwards
Retain business data and mailbox content according to legal and retention requirements; disabling access is separate from deleting records. Keep monitoring for any use of rotated credentials during the following days.
Finally, review the exercise: which access paths were missing from the inventory, and which steps should be automated for the next case?