What happens when somebody leaves?

Their access stops without you changing anything on the network. It takes up to about ten minutes.

How it works. Every ten minutes Passbeam reads account status from the client's Entra ID. If an account is disabled, its certificates are revoked, and the next time one of its devices tries to connect it's refused. Passbeam doesn't contact Microsoft during each connection. What's checked every time is the certificate: that it belongs to this client, hasn't expired and hasn't been revoked.

This covers the VPN as well as the office. The same certificate gets them onto the wired network, the Wi-Fi and the VPN from home, so one disabled account stops all three, with nothing to change on the firewall.

Revoking stops the next authentication. For a device that's already connected, how soon that happens depends on whether the equipment re-authenticates on the timer Passbeam asks for. See “Which switches do 802.1X properly, and which ignore re-authentication?”.

To end a live session straight away, use a connector. See “How do I disconnect a device that is already connected?”.

This is why Passbeam needs read access to accounts in Entra ID. It's also why certificates beat a shared Wi-Fi password: you can't switch off a password everyone knows for just one person.