SCENARIO 03 Identity Governance Graph API SOC 2

Orphaned Access Audit

A SOC 2 Type II audit flagged that terminated employees and contractors were retaining access post-offboarding. PowerShell + Graph API automation detected 42 findings across 4 risk categories. HIGH risk items fully resolved; dynamic group rules updated to prevent recurrence.

Graph API PowerShell Access Governance SOC 2 Type II Identity Lifecycle Entra ID

Business Problem

IDSentinel Solutions' annual SOC 2 Type II audit flagged a critical finding: terminated employees and contractors were retaining access to company systems and applications after their offboarding date. A sample review of 50 accounts revealed that 12 former employees still had active Entra ID accounts with valid group memberships and application assignments — some dating back over 90 days post-termination.

Additionally, the audit identified a large number of guest (B2B) accounts that had been invited for project work but never cleaned up, and several groups with no designated owner — meaning no one was accountable for reviewing or approving access.

Risk

  • Former employees retaining access to sensitive systems post-offboarding
  • Stale guest accounts with no expiration or review process
  • Ownerless groups creating ungoverned access assignments
  • Direct SOC 2 Type II audit finding requiring remediation
  • Potential data exfiltration risk from orphaned privileged accounts

Scope

TargetDetail
Entra ID user accountsAll accounts synced from Active Directory
Guest accountsAll cloud-only guest (B2B) accounts
Security groupsAll groups with no designated owner
Inactive accountsAccounts inactive 30+ days with active group memberships

Solution Design

A PowerShell script using Microsoft Graph API automated detection across four orphaned access categories:

  • Category 1Disabled AD accounts still synced to Entra with active group memberships
  • Category 2Stale guest accounts not seen in 30+ days with active assignments
  • Category 3Ownerless groups with active members but no designated owner
  • Category 4Accounts with no sign-in activity in 90+ days

Hybrid Identity Note: Group ownership for AD-synced groups cannot be set directly in Entra ID or via Graph API — a known Entra Connect limitation. The AD managedBy attribute does not sync to the Entra owner property. Ownership governance for hybrid groups was enforced at the AD layer. This finding was documented as a recommendation to migrate security groups to cloud-only objects for full Entra-native access review capabilities.

Implementation

  • 01

    Run Orphaned Access Audit Script

    PowerShell script executed against Graph API, scanning all four orphaned access categories. Initial run produced 42 findings.

  • 02

    Review CSV Export

    Script exported full findings to CSV for compliance documentation and remediation prioritization by the IAM team.

  • 03

    Remediate Disabled Accounts

    Disabled accounts removed from all AD group memberships via PowerShell. Dynamic group rules updated to exclude disabled accounts using user.accountEnabled -eq true condition.

  • 04

    Update Dynamic Group Rules

    Dynamic membership rules updated to explicitly exclude disabled accounts — preventing future orphaned access from terminated employees automatically at offboarding.

  • 05

    Post-Remediation Audit

    Audit script re-run to validate remediation. HIGH risk findings confirmed at zero. Ownerless groups documented as architectural recommendation — ownership managed at AD layer via managedBy attribute.

Outcome

42 findings detected across 4 categories on initial audit run
5 disabled accounts removed from all AD group memberships via PowerShell
Dynamic group rules updated — future terminated employees removed automatically
Ownerless groups managed at AD layer — architectural gap documented
HIGH risk findings reduced to zero post-remediation
19% total finding reduction — SOC 2 evidence documented

Audit Results

Pre-Remediation

CategoryFindingsRisk Level
Ownerless Groups33MEDIUM
Disabled Accounts with Active Group Membership5HIGH
Inactive Accounts 90+ Days3HIGH
Stale Guest Accounts1MEDIUM
Total42

Post-Remediation

CategoryFindingsStatusNotes
Ownerless Groups30MEDIUMManaged via AD managedBy attribute
Disabled Accounts with Active Group Membership0✅ RESOLVEDRemoved from AD groups + dynamic rules updated
Inactive Accounts 90+ Days3MEDIUMFlagged for manager confirmation
Stale Guest Accounts1MEDIUMUnder review
Total3419% reduction — HIGH risk fully resolved

Files

  • scripts/Get-OrphanedAccessReport.ps1Main audit script — detects all orphaned access categories via Graph API
  • diagrams/orphaned-access-flow.pngAudit and remediation workflow diagram
  • screenshots/Evidence of findings and remediation at each stage