Disconnecting an integration safely

When to disconnect

Reasons to disconnect (not an exhaustive list):

• You are retiring the source system from your stack entirely
• You are switching to a different provider that offers the same signal (Okta to Microsoft Entra, CrowdStrike to SentinelOne, etc.)
• The integration's permissions were tightened on the source side and you prefer to revoke rather than re-grant
• You are winding down a client tenant
• You are temporarily pausing data collection for compliance reasons (rare)

If you just want to stop syncing briefly without fully disconnecting, click Configure on the integration card and turn off Automatic Sync (or set the frequency to Manual only). The integration keeps its credentials and configuration; it just doesn't run on schedule until you turn it back on.

What stays and what goes

Disconnecting preserves your audit trail. Specifically:

In short: historical data stays, future collection stops, credentials are purged. Your risk register and framework assessments still reflect what the integration produced up to the moment of disconnect, with timestamps intact for audit purposes.

The disconnect flow

1. 1
   Open Integrations and click the disconnect icon on the card of the integration you want to remove.
2. 2
   Radius360 asks you to confirm, and reminds you that the saved credentials will be removed and syncing will stop. You can reconnect later by re-entering credentials.
3. 3
   Confirm the disconnect. Credentials are purged immediately, future syncs are cancelled, and the integration card shows Not connected.
4. 4
   Optionally, revoke on the source side as well (recommended; see below).

Revoking on the source side

Disconnecting in Radius360 stops us from using the credentials. It does not automatically revoke them on the source system. For defense-in-depth, also revoke on the source side:

• App registrations and service accounts (Microsoft 365, Google Workspace, etc.). Delete the app registration or its client secret in Microsoft Entra, or remove the service account's domain-wide delegation in the Google Admin console.
• AWS. Deactivate and delete the IAM access key you gave Radius360. If you connected accounts through a role ARN, delete those roles too.
• API-key and token based integrations (Okta, GitHub, and most others). Rotate or delete the API key or token in the source system.

Replacing an integration

When switching from one source to another (Okta to Microsoft Entra, for example), don't disconnect the old one until the new one is Connected and has completed its first sync. That way:

• Controls stay satisfied during the switchover (both integrations are feeding evidence momentarily)
• You can compare the two sources' evidence to spot gaps
• Open risks from the retiring integration don't go orphaned

Once the new integration is healthy, disconnect the old one as normal. Evidence from the old source is preserved; control satisfaction shifts to the new source automatically.

Audit-period considerations

During an active audit, disconnecting an integration that feeds audit-in-scope controls creates visible churn an auditor will ask about. Best practices:

• Avoid disconnecting mid-audit-period unless there's a specific reason (compromise, compliance requirement, cost)
• If you must disconnect, document the reason and the date in your audit records so you can answer the auditor's question directly.
• If you're replacing with another source, do the replacement (not just a disconnect). Auditors are fine with "we switched tools"; they're not fine with "we stopped collecting evidence."

Related reading: Troubleshooting sync failures, Integrations overview.