Key takeaways
- Disable sign-in and revoke sessions on the last day
- Hand over the mailbox and files before removing the license
- Check apps, shared accounts and devices outside Microsoft 365
- Use one written checklist shared by HR, managers and IT
Before the last day
- HR tells IT the departure date and whether it is voluntary
- The manager lists the apps, shared accounts and vendors the person uses
- Decide who receives the mailbox, the files and any ongoing work
- List the devices assigned to the person, including phones and security keys
- Plan the timing: for an involuntary departure, access is removed during the meeting
On the last day
Block sign-in
Disable the account and sign it out of all sessions, so open browsers and phones lose access as well.
Reset credentials
Reset the password and remove MFA methods and app passwords registered to the person.
Remove access
Take the person out of groups, shared mailboxes, Teams and SharePoint sites, the VPN and remote access tools.
Recover devices
Collect laptops, phones and security keys, and remove company data from personal phones enrolled in device management.
Hand over data
Convert the mailbox to a shared mailbox or forward new mail to the manager, and move files to the person taking over the work.
The access people forget
Microsoft 365 is the easy part. The gaps are elsewhere, and they can stay open for months when nobody owns them.
- Line-of-business and cloud apps with their own logins
- Shared accounts: social media, vendor portals and the domain registrar
- Banking, payroll and payment platforms
- Building access cards, alarm codes and door apps
- Personal devices that synced company files
- Admin rights on the firewall, the Wi-Fi or the backups
After they leave
Remove the license once the mailbox and files are handled, so you stop paying for it. Keep the account disabled rather than deleted for as long as your retention rules require. Review sign-in logs for any activity after the departure date, and update the checklist with anything you found, so the next offboarding is quicker.
How we help
Onboarding and offboarding are included with every supported user at ManagedITServices.Tech. The help desk creates and removes accounts, assigns and removes licenses, and changes permissions in file shares, SharePoint and Teams as people join and leave. Managed workstations come with asset and lifecycle tracking, so you know which devices to collect.
Sources
Information on this page is general and is not legal or compliance advice.