OAuth offboarding SCIM cascade

SCIM closed the tile. The token did not notice.

HRIS fires. Okta disables. IT closes the ticket. Fifty refresh tokens the human handed to SaaS vendors are still valid. SCIM never saw them. They are not app assignments. They are grants at Google or Okta as the authorization server. Monday, a vendor is still reading Gmail. The auditor who samples terminated users will find it.

The cascade is ordered on purpose: HRIS event, IdP suspend, revoke grants for that principal, then SCIM where the app supports it, then attach the export. Reverse the middle two and you get a pretty SCIM log and a live Drift-shaped leftover. The longer policy version is the deprovisioning model.

Why SCIM and OAuth are different namespaces

SCIM says "this user no longer exists in your app." OAuth says "this client may still call Gmail as that user." A Salesforce SCIM deactivate can remove the human login and leave a connected app's refresh token from 2023. That is not a Salesforce bug. It is two systems. Your runbook has to name both.

Drift-class replay also hits still-employed users. Termination is not the only revoke story. It is the one auditors sample because HRIS gives them a clean population.

Step order, with owners

Garden leave and legal hold: counsel names the exception and the effective revoke date. Union contracts: automate on effective date, not announcement. Shared mailboxes: separate ticket, personal grants still Friday. M&A: map legacy IdP grants before you merge accounts. Duplicates for ninety days post-close are normal. Terminated-side leftovers are not.

Testing

Quarterly synthetic termination in a test OU. Target: under sixty minutes to zero grants once automation exists. Until HRIS trigger is live, measure ticket age and say so. Board metric: terminated users with nonzero grants. The number should be zero. If it is not, that is the slide, not a footnote.

IdP notes

Google (GA). User-level apps plus org-wide Apps with access. Revoke the user for offboarding. Revoke the client ID if the vendor is dead. Delegated app-access admin for reviewers. Super-admin stays a CC6.1 sample.

Okta (GA). Assignments vs consents. Test with a disposable user. Do not argue from the docs alone.

Entra (Beta). Do not write an SLA that assumes completeness.

What to tell an auditor

"CC6.7 shows disable. CC9.2 shows revoke. Here are ten terminated users and a zero-grant export. SCIM evidence is labelled as app-account deprovision, not as OAuth revoke."

What to do this week

1. Sample ten recent terminations. Publish the leftover count.
2. Add "OAuth grants = 0" to the ITSM template, above the laptop line.
3. Schedule one synthetic drill.
4. Read the model. Trial ScopeMantle for per-user grant lists today. $5 / $6, no seat min. HIPAA not attested.

A disposable-user test you should run tomorrow

1. Create a test user in a sandbox OU / Okta group.
2. Authorize three apps: a calendar tool, an AI summarizer with mail read (if policy allows in sandbox), and a sanctioned CRM via SSO.
3. Confirm all three appear in inventory.
4. Disable the user in the IdP only. Re-check grants. At least the user-consent rows will still be there in most setups. Write down what you see. That screenshot is the training slide for IT.
5. Revoke grants. Confirm zero. Then SCIM-deprovision the CRM.
6. Time the steps. If disable-to-zero is more than an hour by hand, you know why the cascade exists.

Contractors and vendors-in-your-IdP belong in the same drill. If they live in a separate tenant you cannot API, the SOW for that vendor should include a quarterly grant screenshot. Honest limitation. ScopeMantle will not teleport into their Okta.

ITSM text (longer form)

Offboarding: identity cascade
- Effective date (HRIS):
- Legal hold / garden leave ticket (or N/A):
- IdP suspend time:
- Grant export attached (hash):
- Grants remaining after revoke (must be 0):
- SCIM apps completed:
- Shared mailbox ticket (separate):
- Laptop ticket (separate, not a dependency):
- Approver:

Laptop return is not a predecessor. Tokens are not on the laptop. MDM wipe does not revoke Drift. Say it twice so service desk stops sequencing the cascade behind a shipping label.

Failure modes

• SCIM-only runbooks copied from a 2019 Okta professional services deck.
• Revoking by display name after a rebrand.
• Skipping the test user because "docs say deactivate is enough."
• Measuring success as ticket closed, not grants remaining.
• M&A fortnight with no single runbook owner.
• Agency users nobody will ever HRIS-terminate.

Jira is GA if you want the checklist as tickets. ServiceNow is Beta. Slack notifications are Beta. HRIS trigger is Roadmap. Write the labels into the internal design doc so two years from now nobody claims the roadmap item already shipped.

Worked example: contractor on a vendor laptop

The contractor was never in your HRIS. They used a guest Okta account and authorized a diagramming tool with Drive access. The SOW ended Friday. Nobody ran the cascade because there was no HR ticket. Monday the tool still reads customer diagrams. Fix: contractors live in a register with end dates, or they live in the HRIS. A third option is to accept the risk in writing. There is no fourth option called "we will remember."

Agency Salesforce users are the same shape. Your webhook will never fire. Quarterly Connected Apps export plus a contract clause is the control. ScopeMantle will list grants that hit Google or Okta. It will not invent agency humans in a tenant you cannot connect.

What to tell the help desk, in their nouns

Disable is not revoke. Laptop is not a predecessor. Shared mailbox is a different ticket. Legal hold does not automatically mean "keep the AI summarizer." If the form is confusing, they will skip the grant export. Sit with one technician and watch them process a fake termination. Rewrite the form until they do not skip it.

Pricing remains $5 annual / $6 monthly, no seat min, custom 500+, trial via /demo. Entra Beta. HIPAA not attested. Pair with the model when policy people want the longer version.

Field guide: the first ten terminations after the new form

Do not trust the form until ten real tickets use it. Sit with service desk on the first three. If they skip the grant export because the laptop line is above it, move the grant line up. If they paste "N/A" in the hash field, fail the ticket. If legal hold is checked on every ticket because someone copied a template, call counsel.

Publish the leftover rate after those ten. If it is not zero, you still have a cascade gap. That number belongs in the weekly identity standup, not in a private spreadsheet.

SCIM vendors that lie a little

Some apps deactivate the login and keep an integration user. Some keep refresh tokens on a connected-app object. Test the ones you actually use: CRM, ITSM, HRIS itself, the AI summarizer you tolerated. Docs are not the test. The disposable user is the test.

HRIS trigger remains Roadmap. SCIM cascade revoke remains Beta. Inventory and revoke work today. $5 / $6, no seat min, Entra Beta, HIPAA not attested. Model.

Mistakes I keep seeing after the first workshop

People export once and call it culture. People revoke by display name after a rebrand. People promise Entra completeness. People put OAuth rows in the user-access matrix. People send DSAR mail without a case ID. People treat a CASB invoice as grant inventory. People change a score threshold the night before audit. People staff an MSSP sprint with someone who cannot read a scope string. Each of those has a fix already on this page. The failure is skipping the fix because the demo looked polished.

Write the one thing you will not skip this week. Put it on a calendar. If you want the inventory to stay current, the 30-day trial is the productized version of the export. Five dollars per employee per month billed annually, or six dollars monthly. No seat minimum. Custom terms at 500+ employees. Microsoft Entra stays labelled Beta. HIPAA is not attested. Templates stay operator-reviewed. No fabricated customer counts on the customers page.

If you are evaluating us next to a GRC tool, keep both jobs honest. If you are evaluating us next to a consent-intercept tool, stack prevention and inventory. If you are an MSP, register the deal before the demo and keep the counsel gate in the SOW. If you are writing a board slide, use last quarter as the only benchmark we will stand behind. That is enough program for a quarter. The next quarter is whether the leftover-grant count actually moved.

A note for service desk leads

Rewrite the form until a tired technician on a Friday cannot skip the grant line. Watch three tickets. Move the laptop line down. Fail tickets with N/A hashes. Legal hold is a counsel field, not a default checkbox. After ten tickets, publish the leftover rate in the identity standup. If it is not zero, you still have work. HRIS trigger is Roadmap. SCIM cascade is Beta. The form can ship this week.

What you can do without buying anything

Export the IdP list. Deduplicate on client ID. Revoke three rows you cannot explain. Write the CC9.2 versus CC6.7 sentence for your auditor. Add OAuth grants equals zero to offboarding. Put an extension allow-list in one OU. Schedule a Friday tabletop with a fictional client ID. Hash a file and put it in GRC. Those steps do not require ScopeMantle. They do require a calendar and a human who will not skip them.

When those steps start to rot (and they will, usually by week six), the productized version is daily Google and Okta sync, scores, attestation expiry, bulk revoke, and DSAR snapshot on the same inventory. Price is public. Beta labels stay on the page. We will not invent a case study to make the last paragraph feel finished. Start the trial if the calendar is already losing.

Time the disposable-user test and put the minutes in the identity standup. If disable-only leaves grants live (it will), that screenshot becomes the training slide. Docs are not the test. The test user is the test.

Related reading stays on the internal paths already linked above: platform, integrations, demo, and the companion resources or blog posts for this topic. Use those links when you brief a colleague so they get the same product truth: public $5 / $6 pricing, no seat minimum, custom at 500+, Entra labelled Beta, DSAR templates operator-reviewed, no HIPAA attestation, no invented logos. That is the briefing. Everything else is the procedure you can run this week.

Start the trial from /demo when the manual export starts to rot. That is usually week six, not week one.