A2Critical2 accounts
Sign-in recorded after leaving date
An account that signs in after the person has left is either shared, automated, or being used by someone else. All three need an answer today — and the account was still able to authenticate, so nothing technical stopped it.
Evidence
| Expand | User | Company | Left | Days | Last sign-in | Type | Groups | Lic. | Devices | Mailbox | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| b.rennesund@vestholm.no | Vestholm Regnskap AS | 30 Apr 2026 | 111 | 12 Aug 2026 09:41 | Interactive | 14 | 2 | 2 | Shared · 3 delegates | |||||||||||||||||||||||||||||||||||||||||||
b.rennesund@vestholm.no — last 5 sign-in events after leaving date
| ||||||||||||||||||||||||||||||||||||||||||||||||||||
| t.oksefjell@vestholm.se | Vestholm Rådgivning AB | 31 May 2026 | 80 | 04 Aug 2026 16:22 | Non-interactive | 9 | 1 | 1 | User mailbox | |||||||||||||||||||||||||||||||||||||||||||
How this was derived
accountEnabled = true AND employeeLeaveDateTime < 2026-08-20 AND signInActivity.lastSignInDateTime > employeeLeaveDateTime
- Evaluated against
- 412 users
- Leave date present
- 338 users (82%)
- Fell back to inactivity for the remaining
- 74
- Sign-in events read
- 2,411,806 · retained window 30 days
How it accumulated
These 6 accounts accumulated over 11 months — one every 7 weeks. Nothing in the environment stops the next one.
Continuous monitoring flags each within 24 hours of the leaving date.Team
If closed
+4 points3 licenses released · $1,847/year23 group memberships removed1 shared mailbox converted
Fix
Disable the account, remove group memberships, release licenses, convert the mailbox and reassign delegation — as one approved order, with a single record.
Related findings