A salesperson resigned on a Friday, their account was disabled on the Monday, and the offboarding checklist was completed and signed. Three weeks later their new employer pitched against them using a client list that could only have come from one place. The sync client on a personal laptop had kept a valid token and carried on downloading shared folders long after the account was switched off.
Why disabling the account was not enough
Cloud services issue tokens that remain valid until they expire or are revoked, and a sync client uses a refresh token to keep working without prompting for a password. Disabling the directory account prevents new sign-ins and does not automatically invalidate tokens already held by applications. In this case the desktop client on an unmanaged personal machine, installed months earlier when the employee worked from home, continued to authenticate and download changes to shared folders it was still permitted to see. Nothing in the checklist covered applications holding their own tokens, because it had been written when everything ran on the office network.
What the investigation found
Audit logs showed steady synchronisation activity from a residential address across three weeks, covering shared drives the salesperson had legitimate access to while employed. There was no unusual bulk download to alert on, because the sync was gradual and looked exactly like normal use. CISA’s insider threat mitigation guidance describes this pattern well: the damaging cases usually involve authorised access continuing slightly too long rather than a dramatic act of theft on the last day.
“Offboarding checklists are written around the identity system because that is what IT controls directly. The gap is always the things that hold their own tokens: sync clients, mobile mail, connected applications, personal devices with saved sessions. Revoking sessions takes one command and it is missing from most leaver processes I review.”
William Fieldhouse, Director, Aardwolf Security Ltd
The offboarding process that replaced it
The new process does four things on the day someone leaves. It disables the account, revokes all refresh tokens and active sessions, removes the user from every group granting file access, and wipes or retires the company data on any device registered to them. Conditional access now blocks access from unmanaged devices for file services, so a personal laptop cannot hold a sync in the first place. Alerts were added for sign-ins from a device that has not been seen before on an account flagged as a leaver.
See also: Tech!Espresso: Calgary’s Fastest On-Site Computer Repair Experts
Watching the weeks before the resignation
The other half of the answer is detection before the notice period. Data loss prevention alerts on unusual volumes of file access or downloads give you a signal when somebody starts collecting material, which is typically before they resign rather than after. Microsoft 365 and cloud security testing checks whether those controls are configured and whether they can be bypassed from an unmanaged device, and an internal security assessment covers the file shares themselves, since broad permissions are what makes a leaver’s ordinary access so valuable.
Frequently asked questions about leaver access
These questions follow any incident involving a departing employee.
How quickly should access be removed?
On the last working day, and immediately for anyone leaving in difficult circumstances. Where notice periods are long, restrict access to sensitive material at the point of resignation rather than at the end date.
Can you recover data that was taken?
Rarely in a technical sense. What you can do is establish exactly what was accessed and when, which is what makes a legal approach possible, so preserve the audit logs before they age out of retention, and take a copy rather than relying on the platform to hold them.
