Does the Applicant terminate computer access promptly when employee/contractor leaves?
Disabling the account is the first step and not the last. Sessions, tokens, and access held outside your directory all survive it.
What the carrier is actually asking
The carrier is asking whether access is removed promptly when an employee or contractor leaves. Promptly generally means the same day, and for involuntary departures, at the moment of notification.
Why it is underwritten
Former employee access is a persistent exposure with no monitoring attached. It is also the mechanism behind a category of insider incidents that occur weeks after departure, when the organisation has stopped thinking about the person entirely.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Deprovisioning outcomes are measurable in the directory, which makes this more verifiable than most governance questions.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Entra ID | Accounts belonging to departed staff and their enabled state | Disabled promptly, verified by reconciling the directory against the current workforce list |
| Entra ID | Session and refresh token revocation on departure | Sessions revoked, since disabling an account does not immediately end an existing session |
| Entra ID | Guest accounts held by the leaver in partner tenants | External access removed, which no internal process usually covers |
| Microsoft 365 | Mailbox delegation, forwarding, and shared mailbox access | Delegated access removed, since it survives the account being disabled in some configurations |
| Third-party systems | Software-as-a-service accounts outside single sign-on | Applications not federated to the directory, which is where former access persists longest. Attested |
Disabling the directory account stops federated access. An application with local credentials that was never federated continues to work indefinitely, and it is usually the one a departing employee remembers. The remediation is federating everything, and the interim control is an offboarding checklist that names those applications.
What a defensible yes requires
- Departure triggers deprovisioning through a process that runs whether or not a ticket is raised.
- Sessions and tokens are revoked, not only the account disabled.
- Applications outside single sign-on are covered by an explicit checklist.
- Contractors follow the same process as employees.
- Reconciliation between the workforce list and the directory happens periodically to catch misses.
How this answer goes wrong
The process is driven by a manager raising a ticket, so it works for planned departures and fails for the ones that matter. Or the account is disabled while a personal device continues to sync mail on an existing token that nobody revoked.
Frequently asked
How fast is prompt?
Same day for routine departures, immediately for involuntary ones. Carriers rarely define it and claims reviews reveal it.
Should accounts be deleted or disabled?
Disable and retain for a period. Deletion destroys forensic evidence and can break ownership of files and applications.
What about mailbox access afterwards?
Convert to a shared mailbox or delegate access to a manager rather than leaving the account enabled, which is the common shortcut.
How do we verify the process works?
Reconcile the directory against the current workforce list quarterly. It reliably finds accounts the process missed.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture