A 600‑person firm's single sign-on offboarding and quarterly access reviews: SCIM deprovisioning, orphaned accounts and privileged role reviews
A professional services firm of about 600 people running Okta and Microsoft Entra ID for single sign-on across its business applications.
- Scale
- ~600 people, 2 identity providers, a mix of SCIM-connected and manual applications
- Engagement
- 8 weeks to build, then a review every quarter
The challenge
When people left, access was removed by hand from a ticket, and the list of applications behind that ticket was incomplete. Several applications kept their own local accounts outside single sign-on, no one reviewed who held administrator roles, and the firm's auditors and cyber insurer had started asking how quickly a departed employee loses access.
A professional services firm of about 600 people asked a simple question it could not answer: when someone leaves, how fast do they lose access to everything? The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. Its auditors and its cyber insurer had both asked, and the honest answer was that it depended on who handled the ticket.
We started by listing every application and how it connected to Okta and Microsoft Entra ID. Some were fully behind single sign-on and some accepted automated provisioning, called SCIM, which lets the identity provider create and disable accounts itself. A third group kept local usernames and passwords that single sign-on never touched. That third group is where former employees tend to keep access, so it became the first priority.
For the applications that support it, our team set up SCIM deprovisioning, so that ending a person in the HR system disables the account, revokes active sessions and tokens and frees the license. For the rest, a short runbook assigns each step to a named owner, with a deadline and a record that it was done. Nothing depends on remembering an application that only one person knew about.
Then came the sweep. The review found orphaned accounts: former contractors, local accounts with no matching person, shared mailboxes that still allowed sign-in, old service accounts and OAuth grants no one remembered approving. Each was matched to an owner or closed. The privileged role review was just as useful. Standing administrator rights were trimmed, and the roles that remained moved to time-limited elevation with an approval step.
The last piece is the quarterly access review, which keeps the program from decaying. Each application owner confirms or removes every account and role, and the results are filed with the date. The firm can now show an auditor or underwriter how access ends and who checks it. This is the work our team does under cybersecurity and managed IT services. It reduces the chance of lingering access and is not a compliance certification.
What our team delivered
- An inventory of every application and how it is connected to the identity providers: single sign-on only, SCIM provisioning, or local accounts that bypass both
- SCIM deprovisioning for the applications that support it, so that ending a person in the HR system disables the account, revokes sessions and tokens, and removes licenses without a ticket
- A written offboarding runbook for the applications that cannot be automated, with an owner, a deadline and proof of completion for each step
- A sweep for orphaned accounts: local accounts, former contractors, shared mailboxes with sign-in enabled, stale service accounts and unused OAuth app grants, each matched to a person or retired
- A review of privileged roles in Okta, Entra ID and the major applications, removing standing administrator access in favor of time-limited elevation with approval
- A quarterly access review in which each application owner confirms or removes every account and role, with the evidence filed in a dated folder
Result
Ending a person in the HR system now removes access across the connected applications the same day, and the manual steps are tracked to completion. The orphaned accounts found in the first sweep were closed, and every review since leaves a record the firm can hand to an auditor or an underwriter. This is an illustrative engagement, a modeled outcome and not a compliance certification.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 3 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Active Directory health check
Find the misconfigurations that let an attacker go from one stolen password to full control of your domain.
Report within 5 business days
$1,800 per domain
Microsoft Exchange emergency recovery
Mail is down or an Exchange server is compromised. We stabilize, restore and secure it.
Engineer engaged within 2 hours
$2,900 per incident
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
An agent with its own identity and its own token
A named human sponsors each agent. The agent gets its own identity from a blueprint, signs in and receives a token bound to one audience with narrow scopes. The resource server validates the audience, so a token meant for one resource is rejected anywhere else. No passthrough.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.