Identity, Access & Endpoint Security

A returned device may still have active sessions, tokens, cached data, and access to business services. Checks to make Place the device in controlled custody, revoke sessions and tokens, confirm encryption and management state, and follow approved backup or wipe steps. Review access after the return and update inventory before reassignment. When to...

A lost phone may contain active email sessions, authenticator approvals, business files, or device certificates. Removing all account access without a recovery plan can also prevent the employee from reporting the loss or continuing essential work. What to check Confirm the device identity and last check-in, determine whether it is managed, review...

Disabling an employee account may block new sign-ins while existing browser sessions, refresh tokens, application passwords, or device sessions remain active. The exact revocation behavior depends on the identity provider and connected applications. What to check Review the offboarding trigger, active sessions, refresh-token lifetime, federated...

A business account used by a team can become inaccessible if its recovery email or phone belongs to a former employee or unmanaged device. Shared passwords also make it hard to know who changed a security setting. What to check Identify the account owner, current recovery factors, administrators, active sessions, and connected systems. Review provider...

Personal devices can access business email without the same patching, encryption, or remote management as company devices. Blocking all access may be impractical, but unmanaged sessions need clear data and account boundaries. What to investigate Review identity policies, device registration, application protection, download and sharing controls,...

A device may become noncompliant after an operating system update, expired certificate, disabled security agent, or policy change. Access restrictions protect business systems but can also prevent employees from getting the support needed to recover. What to check Check the compliance reason, last device check-in, policy version, encryption and patch...

An employee moving to a new role may retain old system permissions while gaining new ones. Access accumulation can leave people with administrative rights unrelated to their current responsibilities. What to check Compare current group and application assignments with the new role, approval records, privileged access history, and pending requests....

A returned laptop may be intact but lack a charger, security key, dock, or storage media needed for secure reuse or evidence collection. Accessories may also contain configuration or be associated with a different user. What to check Match the device and accessories to inventory records, verify serials, check encryption and management status, and ask...