Inactive Salesforce Users May Still Have Sessions—Close the Offboarding Gap
Correlate inactivity, login history, and MFA state, then end all sessions for an approved user before deactivation.
An inactivity report is not an offboarding decision. Service accounts, integrations, leave cases, delegated administration, and recent sessions can all make a seemingly obvious deactivation risky.
PSForge can generate a consistent Salesforce evidence-gathering and remediation workflow. Identity ownership, approval, execution, and business-impact validation remain manual controls.
Prerequisites and exclusions
Define an inactivity threshold and target population, then obtain API access suitable for user and security queries. Identify HR or identity records, application owners, service-account naming rules, break-glass accounts, and legal constraints.
Exclude integrations, automated users, active leave cases, and unknown owners until reviewed. Never use inactivity alone as proof that access is unauthorized.
Correlate before deactivation
- Generate inactive-user and login-forensics exports.
- Generate the org-wide login-history and active-user MFA exports, then manually correlate candidate rows; those two tasks do not accept a candidate-user filter.
- Manually reconcile each user with HR, ownership, dependencies, and exception records.
- Approve session termination as an all-sessions action for one user; the task discovers and deletes every AuthSession it finds without a preview-only mode.
- Terminate all sessions and deactivate only that explicitly approved user, then inspect the user state manually and document every exception.
Verification and evidence
Confirm approved users show the expected inactive state and no intended access remains. Check integration monitoring and ask application owners to validate dependent processes. If a dependency fails, follow the approved rollback or replacement-owner procedure.
Retain filter criteria, exports, approvals, session-action responses, deactivation responses, and exception owners. These artifacts support an access review; they do not prove complete offboarding or compliance by themselves.
Example Salesforce access review
- Export inactive users, login evidence, and MFA status
- Reconcile candidates with identity and application owners
- Approve or exempt each candidate manually
- For each approved user, authorize termination of the entire discovered session set
- Terminate all sessions, deactivate the user, and manually verify state and dependent services
Final thoughts
The goal is not the largest possible deactivation count. It is a defensible decision for every account without breaking integrations.
PSForge helps assemble the evidence and commands while keeping identity decisions with accountable reviewers.