Twelve weeks of leave shouldn't mean twelve weeks of access.
Pause it. Their access will be restored once they return.
The Problem
Your directory doesn't know when someone takes leave. A worker on a six-month sabbatical looks like any other active employee. During this leave, they still retain access to all of their accounts. And attackers exploit that fact.
State actors targeted dormant accounts belonging to users who no longer worked at the organization, but whose accounts remained on the system.
Leave Is Just Another Stage
Klef treats leave as it does any other lifecycle stage. Once it detects a worker has been placed on leave, it will act according to the leave policy you define. For leave, that may mean temporarily deactivating accounts to prevent sign-in.
Since policies express multiple lifecycle stages, once the worker returns, their access is restored. There is no separate process to apply. Klef follows the active definition from your policy.
policy "Employee access" { category = "Company-wide" applies = segment.employees stage active { target microsoft_entra.user { userPrincipalName = worker.business_email displayName = worker.display_name jobTitle = worker.job.name accountEnabled = true groups = ["All Employees"] licenses = [lookup(table.skus, worker.job.code)] } target slack.user { userName = worker.business_email displayName = worker.display_name title = worker.job.name active = true } } stage leave { target microsoft_entra.user { accountEnabled = false licenses = [] } target slack.user { active = false } }}