What a Microsoft 365 offboarding scan finds after the account is disabled
Disabling an Entra account is the start of offboarding, not the end. Here are the eight access residues a read-only Microsoft Graph scan reads back, and why each one matters to an auditor.
Disabling a user in Entra ID feels like the end of offboarding. It is the start. The account state changes, but the access the person gathered over their tenure does not leave with it. I built the Microsoft 365 offboarding scan in the ITSailor risk tool to read that residue straight from Microsoft Graph. This note lists what it reads and why each item earns a place.
Last verified: 2026-08-03.
Test conditions
The scan runs read-only against Microsoft Graph for one tenant. It pulls the user list with sign-in activity, delegated OAuth grants, service principals, directory-role assignments, app-role assignments, Intune managed devices, mailbox message rules, OneDrive drive summaries, Conditional Access policies, and security alerts. It then joins every disabled account (accountEnabled is false) against those datasets. Nothing is written back.
Results: the eight residues a disabled account leaves
- Licences still assigned. A disabled account holding an assigned licence is billable and reversible with a click. Graph reports it from the user assignedLicenses field.
- Recent sign-in on a disabled account. signInActivity inside the last 30 days on an account marked disabled is a contradiction to investigate before anything else.
- Delegated OAuth grants. A former user can still own oauth2PermissionGrants that let a third-party app act as them. Disabling the account leaves the grant in place.
- Entra directory roles. A leaver who kept a privileged directory role is a standing admin path.
- SaaS app-role assignments. appRoleAssignments to enterprise apps survive the account state change.
- Intune managed devices. A device still bound to the departed user needs a wipe or retire decision.
- Mailbox forwarding rules. An enabled forwarding or redirect rule keeps moving mail after the person leaves.
- OneDrive ownership. A drive with no live owner is data waiting for a transfer decision.
Every finding carries a severity and an evidence-quality label of measured, meaning it came from a real Graph read, not an inferred quiz answer. The offboarding tool is at /tools/offboarding-risk.
Failures and edge cases
Some datasets need extra Graph scopes. If the scan cannot read mailbox rules or Conditional Access, it marks that lens as not-read rather than reporting a false clean. A tenant with zero Conditional Access policies is itself a high finding, because identity then rests on whatever Security Defaults provide.
Where this maps for an auditor
These residues line up with the access-control expectations under NIS2 Article 21 and GDPR Article 32. Detecting them is the evidence that an offboarding actually completed, which is the part a PDF runbook cannot show.
Limitations
This is a read-only scan of Microsoft 365 and Entra. It does not cover Google Workspace, developer platforms, or SaaS reached outside Entra single sign-on. The counts it returns describe one tenant at one moment. It is evidence for a remediation decision, not a compliance verdict.
Expected output
# Reproduce the licence-residue check with Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"
Get-MgUser -Filter "accountEnabled eq false" -All -Property "displayName,assignedLicenses,signInActivity" |
Where-Object { $_.AssignedLicenses.Count -gt 0 } |
Select-Object DisplayName, @{n='Licences';e={$_.AssignedLicenses.Count}}
Offboarding Evidence turns this same residue scan into a recurring, evidence-grade read attached to each departure rather than a one-time tool run, from Offboarding Evidence.
Sources and further reading
Test the same boundary in your environment.
Use a focused diagnostic to compare the lab result with the controls and constraints in your own environment.
Choose a diagnosticMore from Ops Log
Google's admin.directory.user.security scope has no read-only form
Google publishes no read-only form of the admin.directory.user.security scope. The scope that lists a user's OAuth tokens and app passwords is the same scope that deletes them, so treat any grant of it as a write permission when reviewing a third-party app.
The Azure role called Cost Management Reader is not read-only
Cost Management Reader is described as able to view cost data, yet its action list carries a Microsoft.Support wildcard that includes creating and updating support tickets. The built-in Reader role matches it on every Cost Management feature and cannot write a ticket.
A daily offboarding check can prove closure only as a bound
A leaver check that runs once a day can report closure only as a bound between two runs. A Graph 429, including one inside a batch that returns 200, and a membership read that returns nulls can each make a degraded run look clean, so an absence counts only from a run that read cleanly.