Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The reliable way to control SaaS access is to make an authoritative employee system drive a central identity provider, connect applications with single sign-on (SSO) and lifecycle provisioning where possible, enforce MFA and least privilege, and maintain a manual path for every exception. When someone leaves, disable the identity-provider account, revoke its sessions and refresh tokens, deprovision each application, remove app-issued credentials, transfer business data, and verify closure with the application owners. Disabling SSO alone does not guarantee that every existing SaaS session ends.
What a complete SaaS access-control program includes
SaaS access is an identity-lifecycle problem, not just a login configuration. A workable program answers five questions for every service:
- Who is allowed to use it, and which role or group grants that access?
- How does the service authenticate the person: SSO, a direct password, or both?
- How is an account created, changed, suspended, and deleted?
- Which sessions, tokens, API keys, and delegated permissions can remain after the account is disabled?
- Who owns the application and confirms that access has actually closed?
Central identity makes those answers easier to operate, but it does not remove application-level responsibility. Microsoft’s identity guidance describes SSO access and provisioning or deprovisioning based on group membership and employee status; applications that lack a connector, have direct logins, or issue their own sessions still need explicit treatment.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →1. Establish an authoritative source and inventory every application
Choose the source of employment status
Designate the HR system, or another formally approved employee system, as the source of truth for employment status, start date, department, manager, and role changes. Define who may change that record and how an effective departure time is recorded. The offboarding workflow should start from a confirmed event in this system, not from an informal message in a chat channel.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use the same source for joiner, mover, and leaver events. A mover event matters because a person can retain permissions from a former role even after new access is added. Your process must remove access that is no longer justified, rather than only adding the permissions associated with the new job.
Build an application register
Record every service used for company work, including tools acquired by a department or employee outside the normal IT intake process. Reconcile identity-provider assignments with procurement records, team-owner lists, expense data, and other available application records. No single identity provider should be assumed to discover every unsanctioned account.
| Inventory field | What to record |
|---|---|
| Application and business purpose | The service name, what work it supports, and the accountable business owner. |
| Data sensitivity | Whether the service contains personal, financial, customer, source-code, confidential, or regulated information. |
| Login path | SSO, direct username and password, social login, or more than one method. |
| Provisioning method | Automated connector, administrator-created account, invitation, or manual spreadsheet/checklist. |
| Privileged roles | Administrators, billing owners, security roles, API managers, and other elevated assignments. |
| Session and credential controls | Application sessions, refresh tokens, personal access tokens, API keys, OAuth grants, recovery methods, and delegated accounts that can be revoked. |
| Shutdown procedure | The exact disable, revoke, ownership-transfer, and verification steps, plus the expected owner and completion time. |
Mark applications that cannot be automatically deprovisioned. Give each one a named owner and a documented manual procedure; an unowned exception is an access-control gap.
2. Centralize sign-in with SSO and role-based groups
Connect supported applications
For each important SaaS service that supports it, configure SSO through a central identity provider. Prefer group-based assignment over individually granting access. A group should represent an approved business role or team, and membership should come from the employee’s job duties and approved exceptions.
Document whether SSO is enforced. If an application permits a separate password even after SSO is configured, decide whether that path must be disabled, restricted to break-glass administrators, or monitored. A service with both SSO and direct login belongs on the higher-risk portion of the inventory.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Define access rules before assigning groups
For each group, write the job function it represents, the applications it grants, the data classification involved, its approver, and the conditions for removal. Keep exceptions time-limited: record an owner, reason, approval date, and expiration date. Review privileged membership and sensitive application access at a frequency appropriate to the risk and to applicable organizational or regulatory requirements; there is no universal interval that fits every company.
3. Require MFA and prefer phishing-resistant methods
Require multifactor authentication for all users, including administrators. Apply stronger conditional controls to sensitive applications, unusual sign-in contexts, and elevated operations. Where the identity provider and applications support them, prefer phishing-resistant methods such as FIDO2 security keys, passkeys, Windows Hello for Business, or certificate-based authentication, all of which Microsoft identifies in its identity guidance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A FIDO2 security key is an optional authentication aid, not an offboarding mechanism. Before buying one, confirm that the connector type, protocol, browser support, identity provider, and target applications are compatible. The key can help prove a user’s identity; it cannot disable an account, revoke an application cookie, or remove a SaaS session.
Maintain recovery controls as carefully as the primary factor. Record who can reset MFA, how lost keys are replaced, and how emergency accounts are protected. Do not leave a former employee’s recovery email, phone number, or registered device attached to a service during offboarding.
4. Apply least privilege and control administrator access
Grant only the permissions needed for the person’s current job. Keep the number of standing administrators small and separate ordinary work from administration where practical. For sensitive roles, use time-limited, just-in-time elevation when the platform supports it. Microsoft Entra security guidance describes MFA, approval, and limited-duration activation as possible gates for privileged roles.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Review administrator and security-role membership separately from ordinary user access.
- Remove stale assignments when a person changes teams or responsibilities.
- Require an accountable owner and an expiration date for exceptions.
- Use separate administrative identities where the platform and policy support them.
- Record who approved elevated access and what business task required it.
Least privilege also applies to non-human access. During a role change or departure, identify service accounts, API keys, OAuth grants, webhooks, scheduled jobs, and shared credentials that the employee created or controlled. Transfer or rotate them rather than allowing a personal identity to remain the hidden owner.
5. Automate joiner, mover, and leaver changes
Configure lifecycle provisioning
Use a supported lifecycle connector, such as SCIM where available, to create and update accounts from approved identity groups. Map employee attributes deliberately: a department or role change should not accidentally grant a broader group because of a naming mismatch. Test a new hire, a role change, and a departure with a representative low-risk or nonproduction account before relying on the automation.
Test the negative result as well as the positive one. When a user leaves a group, verify that the application removes the old entitlement. When a user is disabled, verify whether the application account is suspended, deleted, or merely prevented from receiving new SSO sign-ins.
Define the manual path
For every application without automated provisioning, maintain a checklist with the application owner, administrator path, expected completion time, evidence to retain, and escalation contact. Microsoft recommends a process for applications that require manual deprovisioning. Microsoft Entra’s app-provisioning service is described as typically running every 20–40 minutes; that is a platform-specific operating pattern, not a universal SaaS deprovisioning deadline.
Monitor failures and exceptions
Alert on provisioning errors, suspended connectors, failed group assignments, and accounts that remain active after a leaver event. Keep an exception register until the owner confirms closure. An automated workflow that silently fails is less reliable than a visible manual task.
Recommended Free Tools
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Former-employee offboarding: the operational checklist
Run these steps from the confirmed departure event and record the effective time. Coordinate HR, the identity administrator, endpoint administrators, and application owners for high-risk departures.
- Confirm the event and scope. Verify the effective departure time, employment status, manager, devices, applications, privileged roles, and any legal or retention requirements. Identify who is responsible for each manual application.
- Disable the central identity account. Disable the account in the identity provider. This blocks new sign-ins through that provider, but it is not proof that existing application sessions have ended.
- Revoke identity-provider sessions and refresh tokens. Revoke active sessions, refresh tokens, registered devices, and other identity-provider credentials within the organization’s approved process. Microsoft’s documented emergency-revocation flow includes disabling the account and revoking sessions.
- Deprovision connected SaaS accounts. Let the lifecycle connector suspend or remove accounts where supported, then check the result. Treat direct-login applications and applications with their own token systems as separate tasks.
- Revoke application-issued access. In each relevant service, revoke active sessions, personal access tokens, API keys, OAuth grants, delegated credentials, recovery methods, and app-specific passwords when those controls exist. The exact menu and capability vary by service.
- Remove privileged access. Delete administrator, billing, security, repository, production, and other elevated roles. Check nested groups and shared administrative accounts, not only the person’s primary profile.
- Transfer business ownership. Reassign files, folders, repositories, dashboards, workflows, calendars, automation jobs, integrations, and customer records. Preserve required business data according to retention policy before deleting an account.
- Rotate shared secrets. Change passwords, API keys, signing secrets, recovery codes, or other shared credentials the former employee could know. Confirm that integrations still work under the new owner.
- Handle company devices and local data. Retrieve equipment and use the organization’s endpoint-management process to remove business data where appropriate. Remote wipe depends on device connectivity; an offline device may retain locally stored data until it reconnects.
- Verify and document completion. Have application owners confirm disablement and session revocation for manual or high-risk services. Record timestamps, evidence, unresolved exceptions, and the person responsible for follow-up.
Why disabling SSO may not end access immediately
Identity-provider disablement normally prevents new authentication through that provider. It does not necessarily invalidate cookies or tokens that an application already issued. Microsoft’s revocation documentation states: “To revoke a session token, the application must revoke access based on its own authorization policies.”
Microsoft documents a default one-hour Entra access-token lifetime, but that figure describes Microsoft Entra behavior, not every SaaS product. An application may keep its own session until its session token expires, until it receives a synchronized disabled state, or until an administrator explicitly revokes the session. Synchronization delays and token designs differ by service.
For a high-risk departure, use the application’s own session-revocation control where available and test the result with a controlled account. Do not promise an organization-wide instant cutoff unless the actual applications, connectors, and token policies support it.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Verification: prove that the account is closed
Check the identity provider
- The account is disabled, removed from access groups, and no longer eligible for privileged activation.
- Refresh tokens, active sessions, registered devices, and recovery methods have been handled according to policy.
- Sign-in and audit logs show no successful activity after the effective cutoff, or every exception is explained and escalated.
Check each SaaS application
- The account is suspended or deleted as required, and direct-login credentials no longer work.
- Application sessions, tokens, API keys, OAuth grants, and delegated access are revoked.
- Ownership of business data and automations has moved to an approved person or service account.
- The application owner has recorded completion or a specific exception with a deadline.
Check devices and shared access
Confirm device return, endpoint-management status, encrypted-storage or wipe actions where appropriate, and rotation of shared secrets. Review team mailboxes, shared drives, code repositories, incident systems, and other resources where membership may not be controlled by the central identity group.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Common failure modes and the fix for each
| Failure mode | Why it happens | Corrective action |
|---|---|---|
| Only the identity-provider account is disabled | Existing app cookies, refresh tokens, or direct passwords are independent of the central account. | Revoke sessions and credentials in each application and remove direct-login paths. |
| A forgotten application remains active | The service was acquired outside formal IT intake or is absent from the app register. | Reconcile identity assignments with procurement, expense, owner, and team records; add the service to the inventory. |
| Provisioning adds access but does not remove it | Group mappings or connector behavior were never tested for mover events. | Test removal from old groups, inspect connector logs, and create an owner-reviewed exception path. |
| A manual task has no accountable owner | The application is known but the shutdown procedure is informal. | Assign an owner, expected completion time, evidence requirement, and escalation contact. |
| Former employee still owns an automation or repository | Ownership is separate from the user’s login entitlement. | Transfer ownership before deletion and verify integrations under the new owner. |
| A lost device is assumed to be wiped | Remote wipe cannot complete while the device is offline. | Use endpoint-management status, retrieve the device, and treat local data as present until the wipe is confirmed. |
| A security key is treated as an offboarding control | MFA hardware proves identity but does not manage SaaS accounts. | Revoke the identity and application sessions independently; handle the key as a credential to recover or disable. |
How to compare identity and governance platforms
Compare products against the applications and policies you actually operate, rather than assuming that a feature label means identical behavior. Ask these questions during evaluation:
- Coverage: Does the platform support SSO and lifecycle provisioning for every important application, including the less common ones?
- Deprovisioning behavior: Does disabling a user suspend the app account, revoke app sessions, or merely stop new identity-provider sign-ins?
- Lifecycle workflow: Can an authoritative employee system trigger joiner, mover, and leaver actions with approvals and exception handling?
- Governance: Can application owners review assignments, certify sensitive access, and remove inappropriate privileges?
- Authentication: Does the combination support required MFA and phishing-resistant methods?
- Operations: Can the team identify manual applications, assign owners, track failures, and demonstrate completion?
- Cost and licensing: Which connectors, governance features, administrators, and automation limits are included in the subscription tier you would actually buy?
Vendor pricing, connector limits, and feature entitlements vary by plan and change over time. Confirm them for your tenant rather than relying on a generic feature matrix.
A practical rollout plan
- Start with the highest-risk applications. Prioritize administrator consoles, production systems, source-code repositories, customer data, finance, HR, and services containing credentials.
- Complete the inventory. Assign owners, classify data, record login and provisioning paths, and document manual shutdown steps.
- Connect SSO and groups. Pilot with a low-risk application, then enforce SSO where direct passwords are not required.
- Enable MFA and stronger methods. Enroll users, protect recovery paths, and test administrator access before enforcing policy broadly.
- Implement least privilege. Remove stale roles, separate administration, and add approval and expiration for exceptions.
- Automate lifecycle events. Test joiner, mover, and leaver scenarios, including failed provisioning and delayed synchronization.
- Run a simulated departure. Use a test account to measure each application’s disablement, session revocation, ownership transfer, and evidence capture.
- Operate and improve. Review exceptions, failed connectors, privileged access, and newly discovered applications on a risk-based schedule.
Questions to answer before declaring offboarding complete
- Was the departure time confirmed by the authoritative employee system?
- Which applications use direct credentials or app-owned sessions?
- Were refresh tokens, cookies, API keys, OAuth grants, and recovery methods addressed?
- Who owns the former employee’s files, repositories, workflows, calendars, and integrations now?
- Were shared secrets rotated where the person could have known them?
- Was the device returned or its endpoint action confirmed, including the possibility of an offline device?
- Which application owners supplied evidence, and which exceptions still have deadlines?
Source guidance and scope
NIST SP 800-210 provides general cloud access-control guidance across SaaS, PaaS, and IaaS. Microsoft’s identity and revocation documentation supplies product-specific examples for SSO, lifecycle provisioning, MFA, session revocation, and Entra timing. Actual behavior depends on each application’s SSO support, provisioning connector, token and session design, administrative controls, and subscription tier. Build and test the runbook against your own application inventory.
Frequently Asked Questions
Is disabling an employee in the identity provider enough?
No. It blocks new sign-ins through that provider, but SaaS applications may retain their own cookies, refresh tokens, direct passwords, API keys, or OAuth grants. Disable the identity, revoke identity-provider sessions, deprovision every application, revoke app-issued credentials, and verify closure.
How quickly does SaaS access end after offboarding?
There is no universal time. Microsoft documents a default one-hour Entra access-token lifetime and a typical 20–40-minute app-provisioning run interval for its platform, but individual SaaS sessions, synchronization, and token policies differ. Use each application’s own revocation control and test your stack.
What should we do with applications that do not support automated provisioning?
List them as manual exceptions, assign a named owner, document the administrator steps and expected completion time, and require evidence of disablement and session revocation. Keep the exception open until the owner confirms completion.
Does a FIDO2 security key remove a former employee’s access?
No. It is a phishing-resistant MFA credential. It can help authenticate an approved user, but it cannot disable accounts or revoke SaaS sessions. Handle account and session revocation separately, then recover or disable the key under your credential process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
