What Actually Happens After Cybersecurity Finds a Problem?
Say HR confirms an employee left the company on Friday. On Monday, the security team sees that their account is still active.
The obvious move is to disable it. Before anyone clicks Disable, though, the team needs to know two things: whether the person will actually lose access, and what the company might lose with them. The account could own a mailbox, automated flow, integration, or data someone still needs. An old session or connected app could also stay open after the central account changes.
Disabling the account is step one of seven
Microsoft 365 guidance breaks a former employee’s offboarding into seven steps. Preventing sign-in is the first one. The rest cover work such as preserving mailbox data, handling devices, forwarding email, transferring access to OneDrive and Outlook data, removing licenses, and eventually deleting the account.
Microsoft also says blocking an account can take up to 24 hours to take effect. Resetting the password prevents sign-in immediately. Entra has another limitation: it cannot directly revoke a session token issued by an application, because that session is controlled by the application itself.
Business dependencies matter too. Microsoft’s Power Automate guidance says orphaned flows can fail when they use connections tied to the departed user’s account. Turning off a login can therefore affect something the rest of the company still expects to run.
What has to happen before the account is truly handled
Find: HR says the employee left, but the account is still active. That gives security something specific to review.
Decide: Before changing it, someone checks what the account can reach, what still depends on it, and who has authority to approve the response.
Fix: Once approved, an administrator disables the account, revokes sessions where needed, and transfers or removes access that should not remain with the user.
Verify: Go back to the systems that control access. Confirm the former employee can no longer sign in, make sure the business processes that need to keep running still work, and record what happened.
That is Find → Decide → Fix → Verify. Later, someone should be able to tell who flagged the issue, who approved the response, what changed, and whether it worked.
In a small security team, those steps may be split across HR, the identity provider, a ticket, a business app, and whoever owns the process that could break. None of those systems sees the whole situation on its own. If the last step is simply “ticket closed,” the team can miss whether access still works somewhere else or whether a critical process stopped with the user.
People change jobs faster than their access gets cleaned up
Microsoft describes the employee identity lifecycle as joiner, mover, and leaver. People arrive, change roles, take on new responsibilities, and leave. Their accounts and permissions have to keep up.
Veza’s 2026 State of Identity & Access report says it studied identity and entitlement data across 160 enterprises. In that dataset, 78,000 former employees, about 3% of employees, still had active credentials. It also found that 38% of identity-provider accounts were dormant, which Veza defines as inactive for at least 90 days.
Those figures come from Veza’s own enterprise telemetry, so they are not universal industry rates. They show how much stale access can build up in large enterprises. A role change can leave old permissions behind, while a local application account or automated workflow can sit outside the place the team normally checks.
Where TPZ fits
TPZ is building an Identity and Access Risk Platform for Microsoft-heavy teams, starting with Microsoft Entra. TPZ’s connection to Entra is read-only today. It lets a team review identity and access data, and it doesn’t change anything in a customer’s environment.
The Design Partner Beta is designed to test the next part: customer review, an approved user disablement, and checking Entra again to confirm the result. TPZ is focused on the handoff between finding an access problem and being able to show how it was handled.
