# An SSO demo is not an offboarding test

Signing in is the easy demonstration. Removing access is the more revealing test.

Published 2026-10-13 · startidea · AI-assisted, source-linked analysis. No hands-on vendor testing.

## Separate the sessions

An identity provider, a web application, and an API client can each maintain their own state. Auth0’s documentation distinguishes application logout from identity-provider session behavior. That distinction explains why a successful SSO login demo cannot establish how quickly an application revokes access after an employee leaves. The behavior depends on the actual integration.

## Use two disposable accounts

In a sandbox you are authorized to test, create an administrator and a normal user. Give the normal user access to a harmless test record. Keep a browser session open, and—if supported—create a scoped test API token. Do not run this exercise with production employees or sensitive records. Write down the expected revocation time before disabling the test user.

## Observe existing access, not just a new login

Disable the user in the identity system. Attempt a new login, refresh the existing application session, and repeat an authorized read using the test token. Record timestamps and response codes. A blocked new login alongside a still-valid long-lived token is a specific finding. It is more useful than saying “SSO works” or “SSO is broken.”

## Ask who owns the cleanup

Determine whether the product supports automated deprovisioning, whether tokens are tied to the user, and whether administrators can revoke active sessions. Then inspect the audit trail for the change. Your acceptance criterion should follow your organization’s risk and access requirements. This checklist does not establish a universal acceptable revocation window.

## Review worksheet

- Declare the revocation window before the test.
- Check new login, open session, and API token independently.
- Verify an administrator can see and terminate remaining access.

## Sources

- [Auth0: single sign-on](https://auth0.com/docs/authenticate/single-sign-on)
- [Auth0: application logout](https://auth0.com/docs/authenticate/login/logout/log-users-out-of-applications)