Employee Offboarding Checklist: 10 IT Steps to Protect Your Company When Someone Leaves

Most employees leave on good terms. They hand off their work, say goodbye and move on. IT offboarding is the process of removing a departing employee’s access while transferring the files, mail and accounts the business still needs. When access lingers after someone leaves, the business carries the risk.

This checklist covers the IT side of offboarding in Microsoft 365, in the order we recommend doing it.

Key Takeaways

• Block sign-in and revoke active sessions on the employee's last day, not at the end of the week.
• Reset the password and remove MFA methods, because a converted mailbox keeps working with the old password.
• Remove forwarding and inbox rules before you convert the mailbox, since inbox rules survive the conversion.
• Decide who keeps the mailbox and OneDrive, by name, before the 30-day default retention runs out.

What should IT do on the employee’s last day?

1. Block sign-in. In the Microsoft 365 admin center or Microsoft Entra ID, block the account from signing in. Do this at the end of the employee's last working session, or before the conversation if the departure is not friendly.

2. Revoke active sessions. Blocking sign-in stops new logins, but phones and browsers that are already signed in can hold a session for a while. Use "Revoke sessions" on the user in Entra ID so every device has to sign in again, which the block then stops.

3. Reset the password and remove MFA methods. Reset the password even if you plan to convert the mailbox. Microsoft notes that if you don't, the original username and password keep working on the shared mailbox after conversion. Remove the user's registered authentication methods so an old phone can't approve a sign-in.

4. Wipe or retire company data on devices. Remove company data from the employee's phone and tablet through Exchange or Intune, and collect company laptops. Files already synced from OneDrive to a personal computer can't be wiped remotely, which is one more reason to manage devices before anyone gives notice.

What happens to forwarding rules and the employee’s mailbox?

5. Remove forwarding and inbox rules. Check the mailbox for forwarding to any address and for inbox rules that copy, move or delete mail. Remove the ones that don't serve the business. Microsoft preserves inbox rules when a user mailbox becomes a shared mailbox, so a rule left in place keeps running after the person is gone.

6. Convert the mailbox to shared, with named delegates. Converting the mailbox keeps the email and calendar history so customers and coworkers don't lose context. A shared mailbox under 50 GB needs no license. Grant access to the specific people taking over the work, write down who they are and set a date to review that access. Don't delete the user account while the shared mailbox needs it as an anchor.

Apps and data

7. Check third-party app grants. Employees often connect outside apps to Microsoft 365, such as scheduling tools, file converters and email add-ins. In Entra ID, review the enterprise applications the user consented to and remove grants that give an outside service access to company mail or files. Then remove the person from SaaS tools that don't use Microsoft sign-in, and rotate any shared passwords they knew.

8. Hand off OneDrive on purpose. When you delete a user, Microsoft keeps their OneDrive for 30 days by default and gives access to the manager listed on the account. You can raise that retention to as many as 3,650 days in the SharePoint admin center. Move the files the business needs into a shared library before the clock runs out, and make sure the manager field in Entra ID names the right person.

How do you verify that access was removed?

9. Review the audit log. Before you close the ticket, look at the Microsoft 365 audit log for the account's last two weeks: large downloads, new sharing links, new forwarding rules and permission changes. Then check it again a few days later to confirm that nothing signed in after the block. Our guide to what the Microsoft 365 audit log shows explains where to look and how long the records last.

10. Write it down. Record who did each step and when, in the offboarding ticket. If a question comes up months later, that record answers it faster than anyone's memory.

Make offboarding routine

The businesses that handle departures well treat offboarding as a standard procedure, not a scramble. HR tells IT the date as soon as it is known, the same checklist runs for everyone and a second person confirms the steps. Microsoft's own guide to removing a former employee walks through the admin center screens for each step.

Talk to Inzo

Inzo helps businesses in St. Louis and Louisville review Microsoft 365 for the gaps that departures expose: lingering sessions, forgotten forwarding rules and shared mailboxes with no owner. Our cyber risk assessment covers access controls across your environment. To talk through your offboarding process, schedule a conversation with our team.