A1Critical6 accounts
Accounts still enabled after leaving date
An enabled account after a recorded leaving date can still authenticate, still holds group memberships and still consumes licenses. Each one is an open door that nobody decided to leave open.
Evidence
| User | Company | Left | Days | Status | Groups | Lic. | Devices |
|---|---|---|---|---|---|---|---|
| b.rennesund@vestholm.no | Vestholm Regnskap AS | 30 Apr 2026 | 111 | Enabled | 14 | 2 | 2 |
| t.oksefjell@vestholm.se | Vestholm Rådgivning AB | 31 May 2026 | 80 | Enabled | 9 | 1 | 1 |
| m.haugsdal@vestholm.no | Vestholm Teknologi AS | 14 Jun 2026 | 66 | Enabled | 21 | 2 | 1 |
| e.storvik@vestholm.no | Vestholm Eiendom AS | 30 Jun 2026 | 50 | Enabled | 18 | 1 | 2 |
| j.lindqvist@vestholm.se | Vestholm Rådgivning AB | 15 Jul 2026 | 35 | Enabled | 17 | 2 | 1 |
| a.kvarme@vestholm.no | Vestholm Regnskap AS | 31 Jul 2026 | 19 | Enabled | 15 | 1 | 1 |
How this was derived
accountEnabled = true AND employeeLeaveDateTime < 2026-08-20
- Evaluated against
- 412 users
- Leave date present
- 338 users (82%)
- Fell back to inactivity for the remaining
- 74
How it accumulated
These 6 accounts accumulated over 11 months — one every 7 weeks. Nothing in the environment stops the next one.
Continuous monitoring flags each within 24 hours of the leaving date.Team
If closed
+6 points9 licenses released · $4,932/year94 group memberships removed8 devices returned to the pool
Fix
Run each as one approved offboarding order: disable, strip memberships, release licenses, hand over the mailbox — with the reason and the approval on the same record.
Related findings