Ops Log tag
#Identity
Reviewed Ops Log notes tagged Identity, written by Michal Jatczak with source links, test context and operational checks.
2 reviewed notes
Lab NoteSecurity & Infrastructure
The delegated OAuth grant that outlives the employee
Disabling an Entra account does not delete the delegated OAuth grants the person consented to. A third-party app can keep acting on a former employee until the grant itself is revoked. Here is how to read them and which scopes to treat as high risk.
By Michal Jatczak
Lab NoteSecurity & Infrastructure
What a Microsoft 365 offboarding scan finds after the account is disabled
Disabling an Entra account is the start of offboarding, not the end. Here are the eight access residues a read-only Microsoft Graph scan reads back, and why each one matters to an auditor.
By Michal Jatczak