Offboarding an engineer from Azure: the access checklists miss
To offboard an engineer from Azure, disable their Entra ID account and then revoke its sign-in sessions, so the tokens it already issued stop working immediately. After that, remove their role assignments, delete the secrets on any service principals they created, and clear Azure DevOps and AKS credentials. The mistake most teams make is thinking that disabling the account cut off access. On Azure it doesn’t happen instantly, and the still-valid tokens are where offboarding quietly fails.
Why disabling the account isn’t enough
Disabling someone in Entra ID (formerly Azure AD) blocks new sign-ins. It does not immediately invalidate the access and refresh tokens already issued to them, which can stay valid until they expire, sometimes for hours. During that window the disabled account can still act, which is why you revoke the sign-in sessions explicitly rather than trusting the account disable alone.
That’s the gap between IT offboarding and Azure offboarding. The IT checklist disables the account. The tokens and service principals underneath it are where an engineer, or a stolen token, can still reach production after they’ve left.
Revoke the sessions, not just the account
This is the Azure-specific step people miss. Disabling the account is necessary but not instant. Revoking the user’s sign-in sessions invalidates their refresh tokens, so existing access can’t be silently renewed. Do this immediately for any sensitive departure, before you move on to the slower cleanup, because it’s what closes the live window.
The Azure access to revoke
Go through what the engineer accumulated:
Their RBAC role assignments, at subscription, resource group, and management group scope, plus any Entra directory roles. Client secrets and certificates on app registrations and service principals they created, since those are standing credentials that outlive the person entirely. Azure DevOps personal access tokens and SSH keys. AKS cluster credentials pulled to their machine. And any PIM eligible role assignments, which keep them able to activate privileged roles unless removed.
Speed matters more than completeness
For a sensitive departure, disable the account and revoke its sessions first, then remove the highest-privilege role assignments. Every minute a valid token outlives the person is exposure you didn’t choose. Closing the worst of it in five minutes beats a perfect sweep in five hours.
The better default: less to revoke
Offboarding on Azure is hard because role assignments and service principal secrets pile up in places nobody tracks. The fix isn’t a better checklist, it’s fewer of them to begin with. Use Privileged Identity Management so privileged roles are activated for a window rather than held permanently, grant access per task so it expires, and keep secrets out of long-lived service principals where you can. Lean on that, and with zero standing privileges there’s almost nothing left to revoke when someone leaves.
The same problem exists on other clouds with different mechanics: see offboarding from AWS and GCP.
Where Korvalis fits
On Azure the leftover problem is tokens that outlive the account disable. Korvalis grants access that expires by itself, shrinking what you have to revoke, and it watches live sessions and stops a destructive command before it lands, covering the window while old tokens are still valid. It installs inside your own Azure subscription.
Frequently asked questions
Does disabling an Entra ID account revoke access? Not immediately. It blocks new sign-ins, but already-issued tokens stay valid until they expire. Revoking the sign-in sessions kills the refresh tokens at once, so access can’t be renewed, though an access token already issued still runs out its short lifetime.
What do people forget to revoke? Active sessions and refresh tokens, RBAC role assignments across scopes, client secrets on service principals, Azure DevOps tokens, AKS credentials, and PIM eligibility.
How fast should you revoke? Disable the account and revoke sessions first, ideally within minutes for a sensitive departure, then remove role assignments and secrets.
If you’d rather have little left to revoke, see how Korvalis handles access or join the waitlist.