TL;DR
In a Microsoft 365 environment, completely offboarding an employee from all connected apps is two jobs:
Job 1, the Microsoft account: Reset the password, sign them out of every session, block sign-in. This gets them off apps like Outlook, OneDrive, Teams and SharePoint, and stops new sign-ins to apps connected through single sign-on (SSO).
Job 2, every other SaaS app: Disabling a user in Microsoft Entra ID only removes them from apps you have connected through SCIM provisioning. From what we see across customer SaaS stacks, that is usually 15–25% of the stack. The rest is usually removed by hand, or with a SaaS access management tool like AccessOwl.
In this guide: the step-by-step order, what each Microsoft action does and doesn't stop, and how to find the apps Entra ID misses.
After analyzing 5,480 offboardings in AccessOwl, we found that full-time employees had to be removed from a median of 17 apps beyond their main workspace (Microsoft 365 or Google). That only counts the apps IT already tracks.
Does blocking sign-in in Microsoft 365 remove access to all apps?
No. Blocking sign-in in Microsoft 365 stops new Microsoft sign-ins. For apps you have set up Microsoft Entra ID to provision through SCIM it also sends a disable signal. Apps outside that keep their own accounts and their own sessions.
Microsoft's documentation is direct about the second part. "Microsoft Entra ID can't directly revoke a session token issued by an application." The app has to end that session itself.
Here is what blocking sign-in reaches, and what it doesn't:
Access type | Blocked when you disable the user? | Why |
|---|---|---|
Outlook, OneDrive, Teams, SharePoint | Yes, within about an hour | Microsoft access tokens last one hour |
Apps Entra ID provisions through SCIM | Yes, on the next provisioning cycle (usually 20–40 minutes) | Entra ID sends a disable to the app |
Apps behind SSO without provisioning set up | Partly. No new sign-ins, but the account and license stay, and an open session can run until it expires | The app's session belongs to the app |
Apps employees set up with a username and password | No | Never connected to Entra ID |
Apps the user authorized with "Sign in with Microsoft" | Partly. The consent grant stays until you revoke it | Consent is a separate permission |
Shared logins and personal-email sign-ups | No | Not tied to the Microsoft identity |
"I'd say maybe 50% of our stack is actually connected to Entra ID."
Head of IT, 180-person software company
The limited coverage of access revocation is not a Microsoft flaw. Any identity provider stops at the apps connected to it. Okta has the same boundary. One reason the gap is so big is cost. Many apps only offer SCIM on their enterprise plan. Our guide to the SSO tax covers why.
Block sign-in, disable or delete: which should you use?
Use all three, in order. Reset the password and sign out every session first, because blocking sign-in can take up to 24 hours to take effect. Then block sign-in to keep them out. Delete the account only after their mailbox and files are handed over, since deleting starts a 30-day clock on their data.
How to offboard a user in Microsoft 365: step-by-step runbook
Use this runbook as a starting point for your own offboarding checklist. For a general checklist beyond Microsoft 365, see our employee offboarding security checklist. On the day of offboarding, close the person's access and hand their email and files to their manager. Within 30 days, remove the license and delete the account. Microsoft's offboarding guide has the clicks for each step.
On the day of offboarding
Reset their password and sign them out of all sessions. Microsoft lists this as the first step, because blocking sign-in can take up to 24 hours to apply. Signing out takes effect within about an hour.
Block sign-in. Do it in the Microsoft 365 admin center, or by disabling the account in Microsoft Entra ID. To cut off email faster, you can also switch off their email apps in Exchange.
Wipe or block their mobile device. Microsoft covers this in its offboarding guide.
Hand over their email and files. Convert their mailbox to a shared mailbox or forward their email to their manager. Then give the manager access to their OneDrive. Forwarding only works while the account keeps its license. Files synced to their computer stay on that computer.
Reassign what they owned. Give their Teams, Microsoft 365 groups and SharePoint sites a new owner.
Remove them from groups. In Microsoft 365, groups often carry access. Removing the person from a group also removes the apps and licenses they got through it.
Revoke their app consents. These are third-party apps they authorized with "Sign in with Microsoft". Microsoft's portal shows them, but revoking them needs PowerShell or Microsoft Graph. Revoking a consent doesn't delete their account inside that app.
Remove them from every app outside Entra ID. Microsoft can't do this step for you. Work from a list of every app the person used and remove them one by one, or with a tool like AccessOwl. This is the step most often missed. In a 2026 survey of 1,000 US workers who had left a job, 79% said at least one work account kept working after their last day. At companies under 250 people, it was 82% (Sagiss, 2026).
Within 30 days
Remove the license. Skip this if their email is being forwarded, because forwarding stops without it.
Delete the user. Skip this if the account holds a shared mailbox or forwarding, since both need the account. After deletion, Microsoft keeps the account restorable for 30 days.
Reduce your license count. Deleting a user doesn't stop the bill on its own. Lower the number of licenses in your subscription, or assign the license to someone new.
If your accounts sync from on-premises Active Directory, disable and delete them there. Microsoft 365 can't delete synced accounts.
Running Google Workspace too? Our Google Workspace offboarding guide covers the same steps.
Automate access removal for every SaaS app with AccessOwl
Keep Microsoft Entra ID as your directory and sign-in layer. Then add a SaaS management layer like AccessOwl on top that removes accounts in the apps Entra ID can't reach, including apps with no SCIM or SSO.
How AccessOwl handles offboarding on Microsoft 365:
Offboarding that reaches apps outside SSO. Accounts are removed in third-party SaaS apps, not only the ones behind single sign-on.
No SCIM needed. AccessOwl connects to each app through an integration account, so the app doesn't need to be on its enterprise plan. Our catalog covers 500+ integrations.
A tracked task for everything else. Apps without an integration (like internal tools) get a removal task with an owner, so nothing is left to memory.
Automatic trigger from your HR system. Offboarding starts on the person's last workday, using the end date in your HR system.
Licenses freed in each app. Accounts are removed, not just blocked at sign-in, so the seats free up. Ongoing shadow IT discovery also helps you spot redundant apps.
Discovered apps included. Apps found through Microsoft 365 OAuth grants are flagged during the offboarding process.
One dashboard. Tasks and approvals live on the web dashboard. Emails notify and remind.
Record of access revocation. Every removal through AccessOwl is logged for SOC 2 and ISO 27001 audits.
"Offboarding a user used to be a solid hour of going through many, many different systems. Now, it's much more streamlined."
Harald Prokop, CTO at Just Appraised (customer story)
What you need | Entra ID P1 | Entra ID P1 + Governance add-on | Entra ID + AccessOwl |
|---|---|---|---|
Close the Microsoft account | Manual steps | Lifecycle workflow | Manual steps in Microsoft, or a Governance workflow if you have it |
Remove access in apps connected through SCIM | Yes | Yes | Yes |
Remove access in apps without SCIM | Manual, app by app | Logic Apps extension you build | Yes, through integration accounts. Tracked task for the rest. |
Find apps outside Entra ID | Sign-in logs and app consents | Adds Account Discovery, on apps set up for provisioning | Scan of Microsoft 365 OAuth grants |
Audit trail | Entra ID logs, 30 days | Entra ID logs plus workflow history | Offboarding log per person across every app |
Trade-off | Covers only connected apps | Separate add-on to license and set up | Each app needs a one-time integration setup |
If you're comparing tools, our guide to the best tools for automating offboarding goes deeper.
How to find and remove access to apps outside Entra ID
Start from a list of every app the person used, then remove each account. Microsoft's own guidance is to "develop a process to also deprovision users to apps that don't support automatic provisioning and deprovisioning." Getting a complete list is the hard part. Not every app is owned by IT, and some tools sit outside SSO entirely.
"During a SOC 2 audit we realized a person had a Deel account because a previous HR person gave them a Deel account and IT simply didn't know."
Senior IT engineer, fintech software company
There are three places to check inside Microsoft 365:
Sign-in logs. The apps the person signed into with their Microsoft account. Kept for 7 days on Entra ID Free and 30 days on P1 and P2.
App consents. Third-party apps they authorized with "Sign in with Microsoft".
Group memberships. Apps they got through a group.
If you're on the Entra ID Governance add-on, Microsoft also offers Account Discovery. It pulls the user list from an app and flags accounts that have no matching person in Entra ID, such as former employees whose app account was never removed. It isn't limited to Microsoft apps, but it only works on apps you've already set up for provisioning in Entra ID, and the app's SCIM connection has to support it. It reports what it finds. Removing the accounts is still up to you. If you're weighing whether the add-on is worth it, we compared it with the alternatives in our Entra ID Governance alternatives guide.
Catching shadow IT apps
Some apps were never in your directory at all. For example:
Apps people signed up for with a username and password.
Free plans someone started on their own.
Accounts made with a personal email.
Shared logins.
There is usually a trail. Almost every SaaS app sends a welcome or invitation email when an account is created. Searching the person's mailbox for those emails is one way to find free and password-only accounts.
For a quick first list, AccessOwl's free shadow IT scan checks your Microsoft 365 OAuth grants. Every app someone signed into with "Sign in with Microsoft" shows up, along with who uses it.
Once you have the list, go app by app. Remove or deactivate the person, move anything they owned to a colleague, and free the seat. Note each removal as you go. You'll need that record for your SOC 2 audit.
Can Microsoft Entra ID automate offboarding?
Partly. With the Microsoft Entra ID Governance add-on, lifecycle workflows can disable the account, remove groups, Teams and licenses, and delete the user on a schedule. Those workflows act on objects inside Entra ID. Reaching another app takes an app with SCIM, or an Azure Logic Apps extension that your team builds and maintains.
What each option can automate:
What you want automated | Entra ID + AccessOwl | Entra ID Free | Entra ID P1 | Entra ID P2 | Entra ID Governance add-on |
|---|---|---|---|---|---|
Start offboarding automatically | Yes, on the person's last workday, from your HR system's end date | No | No | No | Yes, from Entra ID user attributes |
Disable the user and revoke sessions | Manual in Microsoft | Manual | Manual | Manual | In a workflow |
Remove users from apps connected through SCIM | Yes | Yes | Yes | Yes | Yes |
Remove users from apps without SCIM | Yes, through integration accounts. A tracked task for apps without one. | No | No | No | Only through a Logic Apps extension you build |
Use groups to manage app access | Yes, with your existing Entra ID groups | No | Yes | Yes | Yes |
Find accounts left in apps | Free OAuth scan plus ongoing discovery | No | No | No | Account Discovery, on apps set up for provisioning |
Log of every removal | Yes, across every app | Entra ID audit log only | Audit and provisioning logs | Audit and provisioning logs | Audit and provisioning logs, plus workflow history |
Most teams already own some of this without knowing it. Entra ID P1 comes with Microsoft 365 Business Premium and E3. P2 comes with E5. The Governance add-on is separate on all of them.
FAQs
How do I remove an employee's access to all software apps when they leave?
With Microsoft 365 alone, it's two manual jobs. You close their Microsoft account, then you go app by app to remove the accounts Microsoft Entra ID doesn't manage. AccessOwl does the second job automatically. It removes the person from every connected app on their last workday and gives an owner a tracked task for any app without an integration.
Does disabling a user in Entra ID remove their access to other apps?
Only for apps that Microsoft Entra ID provisions through SCIM. Apps that only use single sign-on keep the account and any open session, and apps with their own username and password aren't touched. Closing those by hand means logging into each app's admin panel. AccessOwl removes the account inside each app, which also ends the person's sessions there.
How do I deprovision apps in Entra ID without SCIM?
Microsoft Entra ID can only remove accounts in apps that support SCIM, and many apps only offer SCIM on their enterprise plan. We cover the gap in when SCIM isn't enough. Without it, the Microsoft-only options are removing the account by hand in each app, or building a custom Logic Apps extension on the Entra ID Governance add-on. AccessOwl connects to apps through integration accounts instead, so no SCIM or enterprise plan is needed. It has 500+ integrations.
How do I automate the offboarding process with Entra ID?
The Microsoft Entra ID Governance add-on has lifecycle workflows that disable the account, remove groups and licenses, and delete the user on a schedule. They only act on Entra ID objects and apps connected through SCIM, so every other app stays manual. AccessOwl covers those apps. It starts the offboarding on the person's last workday, using the end date from your HR system, and removes access across every connected app.
How do I find out which apps a former employee still has access to?
In Microsoft 365, you piece it together by hand from Entra ID sign-in logs, the apps the person authorized with "Sign in with Microsoft", and their group memberships. Apps outside Microsoft take more digging, such as searching for welcome emails from SaaS tools. AccessOwl's free shadow IT scan gives you the first list in minutes: every app people signed into with their Microsoft account, and who uses it.
What about apps employees signed up for with a personal email or a password?
These accounts never pass through Microsoft Entra ID, so disabling the user doesn't reach them and no Microsoft log shows them. Doing it by hand means asking the manager, checking expense reports and looking for sign-up emails. Once an app is in AccessOwl, the person is removed from the company's account in it automatically, however they signed up. Where they used a personal email, ask them to hand over or delete any company data.
How do I stop paying for licenses after an employee leaves?
In Microsoft 365, deleting a user doesn't lower your bill on its own. You remove the license, then reduce your license count. In other SaaS apps, the seat only frees up once the account is removed inside each app, and blocking sign-in in Microsoft doesn't do that. Because AccessOwl removes the account in each app, those seats free up as part of the offboarding.
How do I prove to an auditor that an employee's access was removed?
Keep a record for each person who leaves: every app they had, when each account was removed, and who removed it. SOC 2 asks for access to be removed once someone is no longer authorized (AICPA Trust Services Criteria, CC6.2). Microsoft Entra ID keeps its logs for 7 days on Free and 30 days on P1 and P2, and removals done inside other apps never reach them. AccessOwl logs every removal across every app, so the record is ready when the auditor asks.