Disabled Is Not Signed Out: Offboarding a Sole IT Admin
Day 1 after a sole IT admin leaves is an access problem. Every account that can change, delete, or read company data needs a name next to it, and any password the leaver knew has to change, since nobody can say for sure who else has it. The failure mode In a 2024 advisory, CISA and MS-ISAC described a state government breach that began with a former employee's administrator account, one that…
When the only IT administrator leaves a company, access becomes a significant concern. Each account capable of altering, erasing, or viewing corporate data requires a designated owner, and any passwords they may know must be updated, as it's uncertain if others possess them. In 2024, a CISA and MS-ISAC advisory detailed a state government breach that started with a former employee's administrator account.
This account was never disabled after the individual's departure. The attacker likely obtained the password from another data breach, and neither the administrator account they used had multi-factor authentication enabled. It's not necessary for the agency to be targeted; a dormant admin login just needed to exist.
Disabling an account doesn't equate to ending its sessions. By default, Microsoft's Entra ID access tokens remain active for one hour. Applications that maintain their own session cookies may continue to keep a user signed in for an extended period. Microsoft's advice on revoking user access is to disable the account, terminate the sign-in sessions, and, in a hybrid setup, reset the on-premises password twice.
All three actions must be taken, followed by a thorough check of applications that don't utilize Microsoft's sign-in.
If the administrator's passwords are unknown, begin with systems capable of resetting others, such as Microsoft 365, your domain registrar, and the firewall vendor. Each has an ownership-proof recovery process, though it's not instantaneous. Submit requests on the first day. Regarding notice periods, NIST's termination control in SP 800-53 Rev.
5 suggests disabling access within a timeframe defined by the organization, collecting credentials, and conducting an exit interview. The period can be determined by the organization, but I recommend concluding it by the hour the person stops being the individual who should have the keys. Additionally, appoint a second administrator for everything before that date.
Enable multi-factor sign-in for all administrator accounts, or verify that it is already in place. Confirm that the latest backup was completed and that someone else can access the backup console.
In conclusion, disable, revoke, reset, and then examine everything outside the directory. For more detailed information, visit our website at Uprite Services.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
