iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Disable the former employee’s account at the authoritative identity provider, block new sign-ins, and revoke refresh tokens or workforce sessions. Then separately remove the person from every AI workspace and application, disable or reassign each agent identity, revoke OAuth grants and credentials, and remove direct access to connected resources. Finally, test the products and inspect audit logs: central deprovisioning is not proof that every application session, access token, or agent credential has stopped working.
Start with three separate revocation targets
Employee departure creates more than one security object. A corporate user account, an AI agent, and the resources that agent can reach may all have different owners, credentials, session mechanisms, and audit trails. Treating them as one object is the most common reason access survives an otherwise successful offboarding event.
| Target | What to revoke | Evidence that the job is complete |
|---|---|---|
| Former employee identity | Identity-provider account, application assignments, group memberships, refresh tokens, workforce sessions, and new sign-in capability. | The account is disabled, new authentication fails, and active workforce sessions are revoked where the provider supports it. |
| AI product access | Workspace membership, tenant assignment, API-organization membership, invitations, manually managed roles, and unmanaged product accounts. | The product no longer lists the user as a member or administrator, and a test sign-in is rejected. |
| Agent identity | Agent or blueprint object, application permissions, delegated grants, group and role assignments, OAuth consent, secrets, certificates, and API keys. | The agent is disabled or reassigned, its credentials are invalid, and sign-in or activity logs show no continuing use. |
| Connected resources | Cloud IAM entries, project or repository permissions, direct resource policies, integrations, and user-level OAuth grants. | Policy analysis and resource-level checks show no unintended path from the former employee or agent to protected data. |
| Sessions and tokens | Identity-provider refresh tokens, workforce sessions, application-issued sessions, and long-lived access tokens. | Existing browser sessions and API calls fail according to the application’s revocation behavior, not merely because the account is disabled centrally. |
The human account and the agent are different identities
An agent may have a first-class identity in an identity platform, or it may appear as a traditional application, service principal, bot, or other non-human account. Search for both the employee’s identity and every agent, application, or service principal the employee created, owned, sponsored, or administered. Microsoft’s agent guidance explains that audit data can identify agent activity through fields such as agentType, and that agent sign-in resources can identify agentic sign-ins. Do not assume every agent is represented by a dedicated agent object. Microsoft’s agent identity guidance describes the distinction and the available controls.
Recommended Free Tools
Why disabling the employee account is not enough
Account disablement blocks new authentication; it does not necessarily kill every session
An identity provider can stop issuing new tokens after an account is disabled, but an application may continue accepting an access token until that token expires. An application-issued session token is controlled by the application, not by the identity provider. Browser cookies, mobile sessions, command-line credentials, and service-to-service tokens can therefore outlive the central disablement event.
Microsoft’s emergency-revocation guidance states: Ensure applications revoke their own session tokens and stop accepting Microsoft Entra access tokens even if they’re still valid.
That is an application responsibility in addition to the identity-provider action. Microsoft’s employee access-revocation procedure also explains why the practical time to loss of access depends on token type, session lifetime, application behavior, and synchronization delay.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Provisioning automation covers only the objects it manages
SCIM or another central provisioning service can remove a user from assigned applications, but it normally cannot discover every direct invitation, manually granted role, unmanaged account, product-specific administrator role, or resource policy. A successful synchronization means the managed assignment was processed; it does not certify that an independent grant has disappeared.
Prepare an inventory before changing access
Use the departure record, identity inventory, application catalog, and ownership records to build a case for this individual. Record the exact object identifier for each item so a similarly named account or agent is not disabled by mistake.
Free tools Windows power users keep installed
One-click scans. No signup required.
- The employee’s authoritative identity-provider account, aliases, synchronized on-premises account, and privileged roles.
- Identity-provider application assignments, provisioning groups, security groups, and enterprise-app memberships.
- AI tenants, workspaces, API organizations, projects, environments, and administrator roles.
- Agents, blueprints, bots, service principals, traditional application registrations, and automation accounts created or controlled by the employee.
- OAuth-connected applications, delegated consent, client secrets, certificates, API keys, personal access tokens, and stored credentials.
- Cloud projects, repositories, data stores, queues, ticketing systems, and other resources reachable by the user or agent.
- Owners or sponsors for every agent and service identity, including the person who will receive ownership if it remains active.
For each agent, document whether it signs in as a first-class agent identity, a service principal, a legacy application, or a user-delegated integration. Also list the systems it calls and the scopes or roles it uses. The OpenID Foundation’s October 2025 report on identity management for agentic AI describes agent identity lifecycle and governance concerns that make this ownership mapping important.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
| Inventory field | Example evidence | Decision to record |
|---|---|---|
| Identity and owner | User ID, agent ID, service-principal ID, sponsor, and business owner. | Disable, transfer ownership, or retain with a named responsible owner. |
| Authentication method | Interactive sign-in, workload identity, OAuth delegation, secret, certificate, or API key. | Revoke the grant, rotate the credential, or both. |
| Reachable systems | AI workspace, API organization, cloud project, repository, SaaS application, or data store. | Remove direct permissions and verify inherited access. |
| Current state | Enabled, disabled, pending synchronization, or unknown. | Assign an operator and retain evidence of the final state. |
Follow this offboarding runbook
1. Establish scope and ownership
Start from the departure record, not from a single application. Confirm the employee’s legal or corporate identity, identity-provider tenant, synchronized directory account, and administrative roles. Search audit and sign-in data for agents and service principals associated with that identity. In Microsoft Entra, the agent identity resources and audit fields can help distinguish agentic sign-ins from ordinary user activity, but older applications may still require a separate application-inventory search.
Mark every item as one of three states: revoke immediately, transfer and keep active, or intentionally retain with documented approval. A running production agent should not be silently deleted if another team depends on it; transfer its ownership and replace the departing employee’s credentials instead.
2. Disable the human account and terminate sessions
- Disable the employee at the authoritative identity provider and block new sign-ins.
- Revoke refresh tokens and workforce sessions using the provider’s emergency or session-revocation controls.
- Check whether the identity is synchronized from on-premises Active Directory. If it is, follow the provider’s hybrid-identity procedure so the on-premises source does not re-enable or overwrite the cloud state.
- Record the time, operator, account identifier, and result returned by the identity provider.
Microsoft documents account disablement and user sign-in-session revocation in its Microsoft Entra employee revocation guidance. Google Cloud separately recommends revoking workforce sessions when immediate termination of active sessions is required; its procedure is described in Google Cloud’s access-revocation guidance. These actions are the first barrier, not the final application-by-application check.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
3. Remove the person from AI products and identity assignments
- Remove the employee from identity-provider application assignments and provisioning groups.
- Wait for the next successful provisioning synchronization, then inspect the product to confirm that the intended membership was removed.
- Search for direct invitations, manually managed workspace groups, unmanaged accounts, and product-specific roles that central provisioning does not own.
- Remove administrator, billing, API, security, and project roles separately where the product exposes them as independent assignments.
Check tenant, workspace, and API organization scope separately
For OpenAI deployments, check the correct tenant, ChatGPT workspace, and API organization. Tenant-wide access, workspace-level access, and API-organization SCIM have distinct scopes. API organization members and roles remain managed in the API Platform, so removing a workspace assignment does not automatically remove an API organization membership.
Automatic account creation is also separate from SCIM. A user who entered through automatic account creation may not be SCIM-managed, and manually granted workspace access must be removed directly. Use the product’s test-offboarding workflow or a controlled test account where available, then verify the production user’s membership, invitations, and roles. The official details are in OpenAI’s SCIM provisioning and management guidance.
4. Revoke the agent’s own access
- Open the agent or blueprint record and disable it, or transfer it to an approved owner if the business process requires continuity.
- Remove application permissions, delegated grants, group memberships, role assignments, and OAuth consent associated with the agent.
- Revoke or rotate every secret, certificate, API key, personal access token, and stored credential the agent could use.
- Remove the agent from downstream applications and resources, including permissions granted directly to its service principal.
- Search for a legacy application registration or service principal if no first-class agent object exists.
Microsoft Entra object-scoped disablement targets an individual agent or blueprint. Conditional Access can block token issuance for broader categories of agents, but that approach has a wider operational impact and does not prevent agent creation. Microsoft recommends testing such policies in report-only mode before enforcement. Use the controls and inventory for the actual identity type rather than expecting first-class agent controls to find every older service principal. See Microsoft’s agent identity disablement guidance.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
5. Clean up connected resources
Inspect each application’s own session and access policy. Remove direct user entries from cloud IAM policies and resources that are not covered by federation or automated provisioning. Google Cloud recommends Policy Analyzer to identify effective access and notes that manually granted external identities may need to be removed from projects and individual resources.
Review connected apps and integrations for user-level OAuth grants and agent-held credentials. Revoke grants the former employee created, and rotate any secret or key that could have been viewed, copied, or embedded in code. If a credential is shared by multiple workloads, replace it with a new credential assigned only to the approved owner before disabling the old one, then verify that the old credential no longer works.
6. Verify the result and record evidence
Verification should test the actual access paths, not just the administrative action. Capture timestamps and links or identifiers for each result.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Identity provider: the user is disabled, cannot obtain new tokens, and refresh tokens or workforce sessions are revoked.
- Applications: browser and API sessions are terminated according to the application’s own policy, and the product rejects the former employee.
- Provisioning: the synchronization job completed successfully and removed the intended assignment.
- AI products: tenant, workspace, API organization, invitations, manual groups, and product-specific roles no longer grant access.
- Agents: the first-class agent or blueprint is disabled or reassigned; legacy service principals and application registrations are handled; credentials are revoked or rotated.
- Resources: direct IAM entries, project policies, repositories, and data resources show no unintended effective access.
- Monitoring: sign-in, audit, and agent-activity logs show no continuing use after the revocation time.
Record what was removed, what remains intentionally active, the new owner for retained agents, the evidence reviewed, and the time of verification. If a product still shows access after a successful synchronization, investigate direct grants or product-specific roles instead of repeatedly removing the same central group.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose controls by scope, speed, and blast radius
No single control covers every identity and token type. Use the narrowest control that stops the unwanted access, then layer controls where an agent or application has independent credentials.
| Control | Best use | Strength | Limitation or risk |
|---|---|---|---|
| Identity-provider account disablement | Stop a former employee from starting new interactive sign-ins. | Fast, central, and easy to audit for the human identity. | Does not by itself revoke every application session, access token, direct grant, or agent credential. |
| Refresh-token or workforce-session revocation | Terminate provider-managed sessions after an urgent departure. | Shortens the life of provider sessions beyond simple account disablement. | Application-issued sessions and independently issued tokens may remain valid. |
| SCIM or central provisioning removal | Remove managed memberships and assignments across connected products. | Repeatable and auditable for objects in scope. | Direct invitations, unmanaged accounts, manual roles, and resource policies can remain. |
| Agent or blueprint disablement | Stop one known agent identity or blueprint. | Narrow scope and low blast radius for a specific agent. | Does not automatically remove delegated grants, secrets, downstream permissions, or legacy service principals. |
| Credential revocation or rotation | Invalidate secrets, certificates, API keys, and copied credentials. | Stops use of the credential wherever it is accepted. | Requires an inventory and coordinated replacement for workloads that must continue. |
| Conditional Access policy | Block token issuance for a broader category of identities or conditions. | Useful when many agents share a risk condition. | Broader operational impact and no prevention of agent creation; test in report-only mode first. |
The appropriate sequence is usually central identity blocking, session revocation, product cleanup, agent disablement, credential cleanup, and resource verification. The exact time until access fails depends on token expiration, session lifetime, application behavior, and provisioning delay; do not promise an instant cutoff unless the application confirms it.
Troubleshoot access that survives offboarding
| Symptom | Likely cause | Corrective action |
|---|---|---|
| The former employee cannot sign in centrally but still reaches an application. | An application-issued session cookie or access token remains valid. | Use the application’s session-revocation control, invalidate its tokens, and confirm that it stops accepting the provider token. |
| The product still lists the user after SCIM reports success. | Direct invitation, manually managed group, unmanaged account, or product-specific role. | Remove the independent grant in the product and retain the synchronization result as separate evidence. |
| Agent activity continues after the user is disabled. | The agent has its own identity, service principal, secret, certificate, or API key. | Disable or reassign the agent and revoke every credential and downstream permission in its inventory. |
| Cloud resource access remains. | A direct IAM entry or resource policy is outside federation or provisioning. | Use policy analysis, remove the direct identity, and check inherited access at the project and resource levels. |
| Disabling one object breaks an unrelated workload. | A shared service identity or credential was used by multiple agents. | Identify all consumers, issue a replacement credential to the approved owner, migrate workloads, then revoke the former shared credential. |
| A disabled agent can be recreated immediately. | The control stopped a current object but did not restrict agent creation. | Review who can create agents and, if appropriate, test a broader Conditional Access or governance policy in report-only mode before enforcement. |
Make the next departure easier to prove
Keep a current register of human owners, agent sponsors, identity types, credentials, connected systems, and transfer contacts. Require every production agent to have a named owner other than a single employee, and record whether its access is delegated from a user or held by a workload identity. Map direct grants and product-specific administrator roles instead of relying solely on group-based provisioning.
Include an offboarding test in the operating procedure: disable a controlled test identity, run the provisioning cycle, attempt access through the relevant user and agent paths, inspect sign-in and audit records, and document the observed delay before access fails. This establishes how each application actually behaves without assuming that the identity provider’s event is sufficient.
An employee departure is complete only when the human identity, the agent identity, independent credentials, sessions, memberships, and connected resource policies have each been checked and the evidence is recorded.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
