Disabled is not removed

The standard offboarding routine in a Norwegian company looks like this: HR reports the last day of employment, the service desk clears the "Account enabled" checkbox in Entra ID, the case is closed. The routine is documented, it is carried out, and it is insufficient. It is worth being precise about why, because the precision determines which measures actually close the gap.

The time window after the account is disabled

Disabling an account blocks new sign-ins and prevents the issuance of new tokens. It does not revoke tokens that have already been issued. Microsoft's own documentation is explicit: "For applications using access tokens, the user loses access when the access token expires", and "Access tokens might pose a security risk if they need to be revoked within a period shorter than their typical one-hour lifespan".

The default lifetime of an access token is variable, randomly distributed between 60 and 90 minutes (average 75 minutes). A user who signs off with a fresh token at 15:59 can in practice still read from and write to the API until around 17:15, even if the account was disabled at 16:00.

revokeSignInSessions (Revoke-MgUserSignInSession) helps partially: it sets signInSessionsValidFromDateTime to now, invalidates all refresh tokens and the browser's session cookies. It does not invalidate existing access tokens, and Microsoft states there is "a small delay of a few minutes before tokens are revoked". Nor can Entra ID revoke a session token the application itself has issued.

The antidote exists — Continuous Access Evaluation gives near real-time invalidation against CAE-capable resources, and in return extends token lifetime to 24–28 hours for those that are not. The point is that this is an architectural decision someone must have made deliberately, not something that follows from ticking a box.

What survives account deactivation

This is where the real debt sits. Microsoft's own recommended procedure for removing access consists of several separate steps — and the fact that they are separate is the proof:

Update-MgUser -UserId $User.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $User.Id
Get-MgUserRegisteredDevice -UserId $User.Id -All | ForEach-Object {
 Update-MgDevice -DeviceId $_.Id -AccountEnabled:$false
}

Device deactivation is a separate step because account deactivation does not do it. Similarly, Microsoft's Lifecycle Workflows have their own distinct "leaver" tasks: Disable user account, Remove users from all groups, Remove users from all teams, Remove all license assignments from user, Remove all access package assignments for user, Revoke all refresh tokens for user, Delete user. That these are seven tasks and not one tells you exactly what the first task does not do.

Concretely, the following is left behind once the account is disabled:

• Device registrations in Entra ID (documented — a separate step in Microsoft's procedure)
• Group memberships, including memberships that grant access to Teams, SharePoint and third-party apps via SSO
• License assignments — you are still paying
• Access package assignments
• Delegated mailbox access in Exchange. Delegation is a permission on the mailbox, not a property of the account. Microsoft's documentation on shared mailboxes shows the principle directly: the account behind a shared mailbox shall always have sign-in blocked, while the delegates retain full access to the content.
• Guest users the person themselves invited in. The B2B guest is an independent user object in your tenant that authenticates against its own identity provider. The Sponsor attribute points to the inviting user, but is a tracking property — not an access dependency.

In a hybrid environment there is the additional, little-known detail that Microsoft recommends resetting the password twice in on-premises AD before disabling in Entra ID.

The license math

Lifecycle Workflows, which is Microsoft's own automation of this, sits in Microsoft Entra ID Governance — not in P2. Governance costs USD 7 per user/month with an annual commitment, on top of P1 (USD 7) or P2 (USD 10). Stacked, P2 + Governance = USD 17 per user per month before implementation, and with a cap of 50 workflows per tenant.

The legal floor

For undertakings covered by the Norwegian Digital Security Act (digitalsikkerhetsloven) — energy, transport, health, water supply, banking, financial market infrastructure and digital infrastructure — this is no longer a best practice. Section 12 of the Digital Security Regulations (digitalsikkerhetsforskriften), in force since 1 October 2025, states: «Når et arbeidsforhold eller en tjeneste avsluttes, skal en tilbyder av en samfunnsviktig tjeneste sikre at den som slutter ikke lenger har tilgang til virksomhetens nettverk og informasjonssystemer.» [Unofficial translation: "When an employment relationship or a service is terminated, a provider of an essential service shall ensure that the person leaving no longer has access to the undertaking's networks and information systems."] The provision expressly also covers suppliers and contractors.

GDPR Article 32(4) hits everyone: the controller shall ensure that any person acting under its authority who has access to personal data does not process it except on instructions. A former employee no longer acts under your authority.

What this means for Entra Logic

The problem is not that the IT department does not know this. The problem is that a correct offboarding is a sequence of six to ten Graph operations that must be executed in the right order, every time, for every departure, in every tenant — and that in practice it is executed by people under time pressure.

Entra Logic treats an offboarding as a single order — a request that carries its own approval and execution: the request arrives structured from HR or the line manager, approval happens once, and the execution engine runs the entire sequence against Microsoft Graph exactly as it was approved. No sub-task can be forgotten, because no sub-task is performed manually. The continuous synchronization of the estate additionally means that the remnants — orphaned devices, unowned registrations, group memberships without an owner — show up as a work list instead of as a finding during the next audit.

—

Sources

• Microsoft Learn — Revoke user access in Microsoft Entra ID
• Microsoft Learn — Configurable token lifetimes
• Microsoft Learn — user: revokeSignInSessions
• Microsoft Learn — Lifecycle Workflow tasks
• Microsoft Learn — About shared mailboxes
• Microsoft Learn — Properties of a B2B collaboration user
• Microsoft — Microsoft Entra pricing
• Lovdata — Digitalsikkerhetsforskriften (FOR-2025-06-20-1131) (the Digital Security Regulations)
• EUR-Lex — Forordning (EU) 2016/679 (GDPR) (Regulation (EU) 2016/679)