SCIM deprovision disables the SaaS account, but a long-lived personal token still lets the former admin call the API

Identity offboarding appears complete in the UI, yet API access remains because one token type was never linked to account lifecycle enforcement.