Microtechie
Home/Resources/Employee Offboarding

Operations guide

Employee Offboarding: An IT Checklist for Microsoft 365 Organizations

Operations7 min readUpdated October 14, 2026

When someone leaves the business, their access should end at the same time as their employment. In practice, former employees' accounts frequently stay active for weeks, along with mobile email, shared passwords and file-sharing links. A consistent checklist, started on the day, closes those gaps without losing the data the business needs to keep.

Applies toOrganizations using Microsoft 365. The principles apply equally to Google Workspace and line-of-business applications.

On the employee's last day

Step-by-step

  1. Block sign-in and revoke sessions

    In the Microsoft 365 admin center, block the user's sign-in and sign them out of all sessions, so devices that are already signed in lose access as well. Reset the password. For a contentious departure, do this at the moment the employee is informed.

  2. Remove MFA methods and devices

    Remove the user's registered authentication methods, and wipe company data from their mobile devices through Intune or Exchange mobile device management. Collect company laptops and phones.

  3. Handle incoming email

    Convert the mailbox to a shared mailbox and give the manager access, or forward incoming mail to a colleague. Either keeps the address working for customers and suppliers. Set an automatic reply directing correspondents to the right contact.

  4. Secure their files

    Give the manager access to the user's OneDrive before the account is deleted, and move business files to a team SharePoint site or shared drive. Once the account is deleted, OneDrive and mailbox content is retained for only 30 days by default.

Within the following week

  1. Review shared and third-party access

    Change passwords for any shared accounts the employee knew, including social media, supplier portals and banking. Remove them from line-of-business applications, Teams, groups and external sharing links.

  2. Reclaim licences

    Remove or reassign the user's licences once data has been preserved, so you're not paying for an unused seat.

  3. Apply retention or legal hold if required

    If there is any possibility of a dispute, or legal or regulatory requirements apply, place the mailbox and OneDrive on hold before deleting anything.

  4. Delete the account when no longer needed

    After the agreed period, delete the account. If accounts are synchronized from an on-premises Active Directory, disable and remove them there.

Make it repeatable

Agree with HR how IT is notified of departures and by when, and keep a record of each completed checklist. The same discipline applied to new starters, with access granted by role, makes both ends of the employee lifecycle predictable.

Frequently asked questions

Why not just delete the account immediately?
Deleting starts a 30-day countdown on the mailbox and OneDrive. Blocking sign-in secures the account while you decide what data to keep.
Does converting the mailbox to shared need a licence?
Shared mailboxes under 50 GB don't, so the licence can usually be removed after conversion.
What about the employee's personal phone?
Use selective wipe through your device management, which removes company data and leaves personal content untouched.
Before you change anythingConfirm you have a current backup and, where configuration changes affect several users, schedule them outside working hours. If you'd prefer us to handle it, get in touch.

References