Ending access

There are four ways Proxara Connect access ends. Each is set out with what it stops, and what it does not.

A leaver

The firm disables the account in Entra. That is the whole step.

Proxara holds a delegated Microsoft credential for that person. The moment Microsoft refuses to renew it, or refuses a read, Proxara withdraws their access on its own: the stored Microsoft tokens are erased, every Proxara token issued to them is cancelled, and the working records, stand-in mappings and private views made for them are deleted. The console moves them to Needs reconnection.

Offboarding is inherited from the process the firm already runs: no per-person switch in Proxara, no Proxara step to forget, and no second list to maintain.

What it does not stop. Proxara does not poll Microsoft, so the withdrawal lands the next time the connector is used rather than the moment the account is disabled. A connection also lapses on its own after thirty days. Nothing here removes the record of what that person did.

A revoked consent

In the Entra admin center, under Enterprise applications, the administrator can revoke the application's permissions, disable sign-in for it, or delete its service principal. Any of these stops new Microsoft access for the whole firm, unilaterally, without asking Proxara. Restricting the application to chosen users is the same kind of change, aimed at one person.

What it does not stop. Nothing in Proxara observes the revocation, so the console keeps showing the connection as live until somebody next uses it. That request fails, Proxara withdraws that person's access, and the console moves them to Needs reconnection. The person sees a prompt to reconnect, not an explanation.

The connector turned off

One console control, available to a firm owner only, acts on the whole firm at once. It stops the firm's Microsoft authority, clears every part-finished sign-in, and revokes every person's grant, which erases their stored Microsoft credentials, cancels their Proxara tokens, and deletes their working records, stand-in mappings and private views outright rather than marking them closed.

Tools stop being offered in the assistant, work already running cannot finish, and a disabled connector returns unavailable rather than falling through to Microsoft. Proxara's shared trust service then stops signing anything for that firm.

Two consequences follow. The record download for a single request only works for about an hour after that request, and turning the connection off ends it at once. While it is off, employees cannot reconnect themselves: only an owner can restore it.

What it does not remove. The signed activity record, the assistant's own registration with Proxara (kept so a later reconnect can reuse it), the cancelled token rows, and the firm's underlying identity register.

The end of an evaluation or a contract

The closing run turns the connection off through the same mechanism a firm owner would use, records it in the signed log, then reads the state back to confirm it stayed off. It removes the firm's entry from Proxara's shared trust service, waits until every signed record has reached durable storage, and closes the firm's file.

What it does not do. It does not delete anything. The environment and its records are retained, and no automated step deletes a production customer's Connect data. Deleting or transferring that environment is a contractual step under the Data Processing Addendum, completed within thirty days, not something the closing run performs. The written deletion certification is likewise a contractual undertaking, carried out by people rather than produced automatically by the product.

The signed audit store is separate: write once, locked for seven years, and outside any deletion request until that period ends.

The one mechanical caveat

Revoking on the Microsoft side prevents new tokens from being issued. How long Microsoft keeps honouring a token it has already issued is Microsoft's behaviour, on Microsoft's own timing, and Proxara cannot observe it. Proxara's own bound is the part worth relying on: a stored access token is used, with no call to Microsoft, until it is within two minutes of expiry. That is why the immediate stop is the firm owner's switch in the console, run alongside the Microsoft revocation rather than instead of it.

That is why the firm-wide switch in the console runs alongside a Microsoft revocation rather than instead of it: it is the one stop that takes effect immediately.