Offboarded contractor account active
Your IdP access-review flags that an **admin account belonging to a contractor who offboarded 7 months ago** logged in successfully 3 times this week from a VPN exit node, then opened the admin console and viewed (not yet modified) billing and customer-export pages. The account was supposed to be deprovisioned but was only *disabled in one system* — it stayed active in the IdP and retained its admin role. No password reset, no MFA prompt seen in logs. How do you triage whether this is the ex-contractor, a leaked credential, or an attacker, and what do you do?
What a strong answer looks like
Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.
0:00 of about 35 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.