--- title: Offboarding isn't done until roles and sessions both die description: Proper employee offboarding requires more than disabling the identity provider account. Role tables, group memberships, and long-lived sessions or refresh... canonical: https://daily.dev/posts/offboarding-isn-t-done-until-roles-and-sessions-both-die-ugmw3nyui twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Offboarding isn't done until roles and sessions both die | daily.dev og:description: Proper employee offboarding requires more than disabling the identity provider account. Role tables, group memberships, and long-lived sessions or refresh... og:url: https://daily.dev/posts/offboarding-isn-t-done-until-roles-and-sessions-both-die-ugmw3nyui og:image: https://api.daily.dev/og/posts/UGMw3nyui.png og:image:alt: Offboarding isn't done until roles and sessions both die og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Offboarding isn't done until roles and sessions both die **[Auth By Example](https://daily.dev/sources/7eadcwhmohx0bchehapmt)** · [@authbyexample](https://daily.dev/authbyexample) · 1 min read · 1 upvotes · 0 comments ## Summary Proper employee offboarding requires more than disabling the identity provider account. Role tables, group memberships, and long-lived sessions or refresh tokens can keep granting access for hours or indefinitely if not explicitly revoked. A five-step checklist covers disabling IdP accounts and tokens, revoking sessions and refresh tokens per app, removing group memberships that map to roles, confirming membership tables actually sync, and checking break-glass or shared admin groups. A suggested test: try an API call with a still-valid refresh token after offboarding to catch gaps in the revoke path. ## Content Offboarding often stops at "disable the IdP account." That's incomplete. Role tables, group memberships, and long-lived sessions can keep working for hours — or forever — if nothing revokes them. When someone leaves: 1. Disable or delete the IdP user (and any personal access tokens). 2. Revoke active sessions and refresh tokens for every app that issued them, not just the SSO cookie. 3. Remove them from IdP groups that map into app roles. If you sync groups on a schedule, check the lag — a nightly sync means they keep the role until tomorrow. 4. Confirm the app's membership table actually dropped (or marked inactive) after sync. Stale rows are a common source of "ghost access." 5. For break-glass or shared admin groups, verify they weren't in those either. A quick test: after offboarding, hit an API that requires one of their old roles with a still-valid refresh token. If it succeeds, your revoke path has a hole. Don't treat "user disabled in Okta/Entra" as the finish line. Treat "no live session + no group membership + no local role row" as the finish line. ## Similar posts on daily.dev - [Onboarding and Offboarding: The Decision You Didn't Know You'd Already Made](https://daily.dev/posts/onboarding-and-offboarding-the-decision-you-didn-t-know-you-d-already-made-kpbrspgav) · strongdm · 0 upvotes · 0 comments - [How to reassign resource ownership before someone’s last day](https://daily.dev/posts/how-to-reassign-resource-ownership-before-someone-s-last-day-umubjjbi6) · The New Stack · 0 upvotes · 0 comments - [Dormant Accounts Leave Manufacturing Orgs Open to Attack](https://daily.dev/posts/dormant-accounts-leave-manufacturing-orgs-open-to-attack-qf0quuqzr) · Security Boulevard · 0 upvotes · 0 comments - [GitHub ships break glass credential revocation](https://daily.dev/posts/github-ships-break-glass-credential-revocation-cii7k9djr) · Aikido Security · 0 upvotes · 0 comments - [Self-service credential revocation for incident response](https://daily.dev/posts/self-service-credential-revocation-for-incident-response-q0eqouakt) · GitHub Changelog · 0 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/offboarding-isn-t-done-until-roles-and-sessions-both-die-ugmw3nyui) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/offboarding-isn-t-done-until-roles-and-sessions-both-die-ugmw3nyui","headline":"Offboarding isn't done until roles and sessions both die","text":"Proper employee offboarding requires more than disabling the identity provider account. Role tables, group memberships, and long-lived sessions or refresh tokens can keep granting access for hours or indefinitely if not explicitly revoked. A five-step checklist covers disabling IdP accounts and tokens, revoking sessions and refresh tokens per app, removing group memberships that map to roles, confirming membership tables actually sync, and checking break-glass or shared admin groups. A suggested test: try an API call with a still-valid refresh token after offboarding to catch gaps in the revoke path.","url":"https://daily.dev/posts/offboarding-isn-t-done-until-roles-and-sessions-both-die-ugmw3nyui","datePublished":"2026-09-29T05:45:24.562Z","dateModified":"2026-09-29T05:45:41.622Z","author":{"@type":"Person","name":"Auth By Example","url":"https://daily.dev/authbyexample","image":"https://media.daily.dev/image/upload/s--Fgz7IgGQ--/f_auto/v1789653205/avatars/avatar_7EADCwHmOHX0bChEhAPmt?_a=BAMAMicg0","interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":60}},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/7eadcwhmohx0bchehapmt","name":"Auth By Example"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Auth By Example","item":"https://daily.dev/sources/7eadcwhmohx0bchehapmt"},{"@type":"ListItem","position":3,"name":"Offboarding isn't done until roles and sessions both die"}]} ```