Verify Host Header and request URL match.

Correct. I am misusing the word hostheader. I mean Host. I can manipulate the host to be whatever I want...therefore, I want to make sure that the Host they're requesting is "sharepoint.com" and not anything else...does that make more sense?

re: disgruntled employee. agreed. we don't have a good offloading process and sometimes the team that disables user accounts/access miss one every once in a while. our Sharepoint environment isn't set up ideally. which is why we're trying to address it via f5.

thanks for replying!