## TL;DR
Disable the accounts first (AD, Entra, Okta, Google), revoke sessions and tokens, then work through the full inventory: VPN, SaaS apps, email forwarding, shared credentials, physical access. Verify each one; "probably revoked" is not revoked.

## The error
```text
(Urgent: terminated employee may still have access. Time-sensitive.)
```

## Steps
1. Immediately disable the core identities: AD account (disable), Entra ID (block sign-in), Okta (deactivate), Google Workspace (suspend). Expected: all four done within minutes. Do this before reading further.
2. Revoke sessions: in each IdP, revoke all active sessions and refresh tokens for the user. Expected: sessions killed. A disabled account with a live session token can still act.
3. Reset shared credentials the person knew: shared admin passwords, Wi-Fi PSK if shared, safe combinations. Expected: rotated. This is the step most often skipped.
4. Work the app inventory: VPN access, SaaS apps (check SSO assignments and any non-SSO accounts), email delegation and forwarding rules, distribution lists, code repo access, cloud console access. Expected: each confirmed removed.
5. Physical: collect badge, laptop, and keys; disable badge in the access system. Expected: confirmed with facilities. Then verify: attempt a test login to the main systems and confirm failure.

## When to use
- Termination missed by the normal workflow
- Involuntary termination requiring immediate containment
- Suspected malicious ex-employee

## When not to use
- Planned offboarding with lead time (use the standard checklist)
- Contractor end dates (use the contractor lifecycle)

## Compatibility
- Any identity stack; adapt the system list to your environment

## Variants
### Employee was remote
Prioritize session revocation and credential rotation; physical collection happens by mail.
### Termination happened weeks ago
Assume the worst: rotate everything they touched and review audit logs for post-termination activity.

## Why it happens
Offboarding touches a dozen systems owned by different teams. Any gap (a missed SaaS app, a live session, a shared password) leaves real access, and attackers know ex-employee accounts are rarely watched.

## Edge cases
- Email forwarding rules the ex-employee set: check for auto-forwarding to personal addresses; remove them.
- Legal hold: preserve the mailbox and files before deleting anything.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yMGy7N8PbqiULzKL3SkXbw