Departed employee retains SSO or SaaS access post-departure

Employee departure is a moment where identity hygiene routinely fails. HR closes the employment record; IT disables the primary SSO account; but the long tail of individual SaaS accounts, personal-device-linked apps, and cross-tenant integrations (Slack, project management, marketing platform, code hosting, e-sign) often survives for weeks or months. ## Why attackers exploit it A departed employee with retained access is either a direct insider risk (if the departure was contentious) or an inherited attack surface (if the departed employee's credentials later leak in an unrelated breach and the attacker discovers they still work). Either path leads to a compromise no active-employee monitoring will catch. ## Remediation direction A single offboarding checklist tied to the identity provider that enumerates every SaaS, every shared credential, every OAuth integration, and every personal-device-linked app — completed and signed off on departure day. Quarterly audit of the identity provider for accounts that have not been used in 60+ days.