Revoking Hidden OAuth & Mobile App Access After an Employee Leaves

Article summary: Disabling an employee’s account is not the same as revoking their access. OAuth tokens and mobile app sessions can persist long after a user account is closed, giving former employees a silent path back into company data. OAuth access revocation during offboarding requires a separate, deliberate step that most businesses skip entirely.

Employee offboarding usually follows a familiar checklist: disable the user account, collect company equipment, revoke building access, and change shared passwords. What often gets overlooked are the third-party applications that employee connected to your business accounts during their time with the company.

Many cloud applications use OAuth (Open Authorization), a standard that lets users securely grant apps access to services like Microsoft 365 or Google Workspace without sharing their passwords. Those permissions are often represented by long-lived access tokens. Simply disabling a user account does not always revoke those authorizations, leaving connected applications with access that should have been removed during offboarding.

A complete offboarding process should include reviewing and revoking unnecessary third-party access, ensuring former employees and the applications they authorized can no longer reach your business data.

Why Disabling the Account Is Not Enough

Disabling a user account prevents new sign-ins, but it does not automatically remove every OAuth authorization or third-party application the user previously connected to your business accounts. 

Many cloud applications rely on refresh tokens to maintain authenticated sessions, which is why Microsoft recommends revoking user sessions and refresh tokens as part of responding to compromised or inactive accounts.

The broader challenge is managing long-lived credentials that can outlast the employee who created them. OAuth tokens, API keys, and other non-human identities should be inventoried, reviewed, and revoked when they are no longer needed. The OWASP Non-Human Identities Top 10 identifies improper offboarding as a significant security risk.

The Hidden Risk of Connected Apps

Most employees don’t think twice about connecting third-party apps to their business accounts. Over time, those connections add up. A project management tool links to cloud storage, a CRM syncs customer data, a scheduling app accesses calendars, and a collaboration platform connects to email or messaging services.

Each of those connections creates an OAuth authorization that may continue to exist even after the employee leaves, especially if it is never reviewed or revoked. In a bring your own device (BYOD) environment, those authorizations often remain on personal devices that are no longer under company control. 

The risk became clear during the Salesloft Drift OAuth breach, where attackers abused stolen OAuth tokens to access downstream customer environments. 

Security guidance from Obsidian Security explains that OAuth tokens can provide persistent access to connected applications if they are not properly managed. That is why reviewing and revoking unnecessary OAuth authorizations should be a standard part of every employee offboarding process.

Beyond Disabling the User Account

Revoke active sessions and review connected apps

Disabling an account prevents new sign-ins, but it should also be accompanied by revoking the user’s active sessions and reviewing any third-party applications that were authorized through Microsoft 365 or Google Workspace. 

Both platforms give administrators the ability to revoke active sessions and review connected applications, but these steps are not automatic. They should be a standard part of every employee offboarding process.

Microsoft’s guidance on revoking user access and Google Workspace’s guidance on managing third-party app access provide additional details.

Remove company data from mobile devices

If the employee used a company-managed device, your offboarding process should include removing corporate data or remotely wiping the device when appropriate. For bring your own device (BYOD) programs, remove the organization’s work profile or managed business data while leaving the employee’s personal information intact.

Review API keys and other long-lived credentials

Not every application relies on OAuth. Some integrations use API keys, service accounts, or app-specific passwords that can remain active after an employee leaves. Review these credentials during offboarding and revoke or rotate any that are no longer needed.

This process goes hand in hand with regular third-party app permission reviews. The same inventory you use to audit connected applications throughout the year should also be part of your employee offboarding checklist, helping ensure unnecessary access is removed when someone leaves the organization.

Make OAuth Reviews Part of Every Offboarding

The goal is not a one-time cleanup. Reviewing and revoking third-party app access should become a standard step in every employee offboarding process.

• Add OAuth and third-party application reviews to your offboarding checklist alongside account deactivation.
• Assign responsibility for reviewing connected applications and revoking unnecessary access before or on the employee’s last day.
• Maintain an inventory of approved third-party applications so you can quickly identify what access needs to be removed.

A documented process helps ensure OAuth authorizations, API keys, and other long-lived credentials are reviewed every time an employee leaves, reducing the chance that unnecessary access is overlooked.

Is Your Offboarding Process Really Complete?

Disabling a user account is only part of the offboarding process. Reviewing connected applications, revoking unnecessary access, and removing long-lived credentials helps ensure former employees and their authorized apps no longer have a path to your business data.

Unbound Digital can review your current offboarding procedures, identify gaps in how third-party access is managed, and help you build a repeatable process that protects your business long after an employee’s last day.

Call us at 423-467-7777 or contact us online to get started.

Article FAQs

Does deleting a user account revoke their OAuth tokens?

Not always. Disabling an account prevents new sign-ins, but third-party applications and OAuth authorizations may require additional review or revocation. As part of employee offboarding, administrators should verify that unnecessary app access and active sessions have been removed.

What is a refresh token, and why does it matter?

A refresh token allows a trusted application to obtain new access tokens without requiring the user to sign in every time. If it isn’t revoked when an employee leaves, it may allow an existing connection to persist longer than intended.

How do I revoke OAuth access in Microsoft 365 or Google Workspace?

Both Microsoft 365 and Google Workspace provide administrators with tools to revoke active sessions and manage connected applications. The exact steps vary by platform, but reviewing third-party app access should be a standard part of every offboarding process.

What if the employee used a personal device?

That’s one reason reviewing OAuth authorizations is so important. Once unnecessary access is revoked through your identity platform, the associated application can no longer use that authorization to access your business data, even if it remains installed on the employee’s personal device.