IT Offboarding Checklist: What to Do When an Employee Leaves

Disable sign-in

The first action, timed with the employee's departure, is to disable sign-in on the Microsoft 365 account. This prevents further access while preserving the mailbox and OneDrive contents for retention. Do not delete the account: deletion comes later and only after data is secured.

Revoke sessions

Disabling sign-in alone doesn't cancel already-authenticated sessions. Explicitly revoke sessions in Entra ID so any open browser or mobile app tokens are invalidated immediately.

Reset or transfer access

• Reset the password (further blocks re-authentication)
• Remove from all groups that grant application or file access
• Remove any admin roles
• Transfer ownership of files, sites, and Teams they owned

Email and OneDrive retention

Depending on your industry, you may need to retain email and files for months or years. Apply your retention policy before deletion. In Microsoft 365 you can typically convert the mailbox to shared, apply a litigation or retention hold, and move OneDrive contents to a designated location.

Shared mailbox conversion

Converting the mailbox to shared preserves the email history and can be accessed by a manager or successor without holding a licence. For roles where the ex-employee received customer email, this is often the safest option.

Device return

• Collect the laptop, dock, and any assigned peripherals
• Sign out and wipe the device via endpoint management
• Reimage for the next user or return to inventory
• Recover any mobile phones or tablets issued by the business

MFA methods

Remove any MFA methods tied to the user's personal device (authenticator app, personal phone number) so they cannot be used to re-authenticate. This is often overlooked.

Password changes

Rotate any shared credentials the employee had access to, such as service accounts, shared inboxes, Wi-Fi keys, and admin passwords. This is the biggest gap in most offboarding processes.

Third-party applications

• Line-of-business software: revoke the user's access
• SaaS tools with individual accounts (CRM, accounting, project tools)
• External vendor portals they had login to
• Password manager: transfer any business-critical vaults, then remove the user

Data ownership

Confirm that any business data on personal devices (BYOD phones, personal laptops if allowed) is removed. If your MDM policies allow selective wipe, run it. If not, treat this as a gap to close in your policy.

Documentation

Record the offboarding date, who performed each step, and what was retained or transferred. This is essential for audit trails and for any future data requests.

Frequently asked questions