The dangerous assumption
When someone leaves an organization, the first action is usually to disable their main identity-provider account. That is necessary, but it does not prove that access is gone. Active sessions, API keys, personal access tokens, local accounts, non-SSO applications, VPN certificates, cloud credentials, and physical badges can outlive the central identity.
Measure residual access
A better question is: how long after departure could this identity still reach any organizational resource? I think of that period as the residual access window. The goal of offboarding is to drive it toward zero across every access path, not merely complete one ticket. This framing exposes dependencies and makes partial completion visible.
Build an evidence-based checklist
Inventory access by category: identity provider, email, endpoint, network, cloud, source control, SaaS, secrets, MFA devices, and physical access. Assign an owner to each revocation step and capture proof such as a revoked token timestamp or disabled badge record. High-risk roles should trigger immediate session revocation and key rotation, not only account suspension.
Design for the next departure
Manual heroics do not scale. Connect HR events to a workflow, centralize applications behind SSO where possible, reduce long-lived credentials, and review exceptions. Offboarding quality is really an architecture test. If the organization cannot quickly explain and revoke someone's access, the access model was already too fragmented before that person left.