What a Microsoft 365 offboarding scan finds after the account is disabled

Disabling a user in Entra ID feels like the end of offboarding. It is the start. The account state changes, but the access the person gathered over their tenure does not leave with it. I built the Microsoft 365 offboarding scan in the ITSailor risk tool to read that residue straight from Microsoft Graph. This note lists what it reads and why each item earns a place.

Last verified: 2026-08-03.

Test conditions

The scan runs read-only against Microsoft Graph for one tenant. It pulls the user list with sign-in activity, delegated OAuth grants, service principals, directory-role assignments, app-role assignments, Intune managed devices, mailbox message rules, OneDrive drive summaries, Conditional Access policies, and security alerts. It then joins every disabled account (accountEnabled is false) against those datasets. Nothing is written back.

Results: the eight residues a disabled account leaves

1. Licences still assigned. A disabled account holding an assigned licence is billable and reversible with a click. Graph reports it from the user assignedLicenses field.
2. Recent sign-in on a disabled account. signInActivity inside the last 30 days on an account marked disabled is a contradiction to investigate before anything else.
3. Delegated OAuth grants. A former user can still own oauth2PermissionGrants that let a third-party app act as them. Disabling the account leaves the grant in place.
4. Entra directory roles. A leaver who kept a privileged directory role is a standing admin path.
5. SaaS app-role assignments. appRoleAssignments to enterprise apps survive the account state change.
6. Intune managed devices. A device still bound to the departed user needs a wipe or retire decision.
7. Mailbox forwarding rules. An enabled forwarding or redirect rule keeps moving mail after the person leaves.
8. OneDrive ownership. A drive with no live owner is data waiting for a transfer decision.

Every finding carries a severity and an evidence-quality label of measured, meaning it came from a real Graph read, not an inferred quiz answer. The offboarding tool is at /tools/offboarding-risk.

Failures and edge cases

Some datasets need extra Graph scopes. If the scan cannot read mailbox rules or Conditional Access, it marks that lens as not-read rather than reporting a false clean. A tenant with zero Conditional Access policies is itself a high finding, because identity then rests on whatever Security Defaults provide.

Where this maps for an auditor

These residues line up with the access-control expectations under NIS2 Article 21 and GDPR Article 32. Detecting them is the evidence that an offboarding actually completed, which is the part a PDF runbook cannot show.

Limitations

This is a read-only scan of Microsoft 365 and Entra. It does not cover Google Workspace, developer platforms, or SaaS reached outside Entra single sign-on. The counts it returns describe one tenant at one moment. It is evidence for a remediation decision, not a compliance verdict.

Expected output

# Reproduce the licence-residue check with Microsoft Graph PowerShell
Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All"
Get-MgUser -Filter "accountEnabled eq false" -All -Property "displayName,assignedLicenses,signInActivity" |
  Where-Object { $_.AssignedLicenses.Count -gt 0 } |
  Select-Object DisplayName, @{n='Licences';e={$_.AssignedLicenses.Count}}