Microsoft 365 offboarding has two jobs that must happen in the right order: remove the departing person’s access and preserve the organization’s work.

Deleting a user immediately may feel decisive, but it can complicate mailbox, OneDrive, application, and ownership decisions. Leaving the account active while people sort those decisions creates a different risk. A controlled checklist separates access containment from data disposition.

This is an administrative checklist, not employment or legal advice. Human resources, management, and legal counsel should decide the effective time, preservation requirements, personal-data boundaries, and communications. IT should execute the authorized technical plan and record the result.

01

Before the departure time

Name one business owner for the offboarding. Confirm the exact effective time and whether the departure is routine, immediate, or subject to a preservation instruction.

Inventory the user’s likely business access:

  • Microsoft 365 and Microsoft Entra ID
  • Mailbox, calendar, aliases, distribution lists, and shared mailboxes
  • OneDrive, SharePoint, Teams, and Microsoft 365 groups
  • Company computers and mobile devices
  • Password manager, finance, CRM, line-of-business, and vendor portals
  • Building access, alarm, phone, and physical keys where applicable
  • Administrative roles, service accounts, app registrations, or automation ownership

Do not ask a departing employee to send passwords. Business systems should be transferred through administrative access, delegated ownership, or vendor-supported recovery.

02

At the authorized cutoff

Reset the account password, revoke active sessions or refresh tokens, and block sign-in. A browser or mobile app may retain an active session if sign-out is not explicitly handled.

Then address connected access:

  1. Disable or retire company-managed devices according to policy.
  2. Remove privileged administrative roles and group memberships that are no longer needed.
  3. Revoke remote-access, VPN, password-manager, and third-party application sessions.
  4. Rotate shared secrets only where the former user knew a shared credential that still exists.
  5. Preserve the execution log, including administrator, time, and each completed action.

For an immediate or high-risk departure, sequence and verification matter more than a long checklist. Secure the identity and privileged paths first, then complete data transfer and cleanup under the approved plan.

03

Preserve mailbox and OneDrive information deliberately

Decide who needs the former employee’s business email and files, for how long, and for what purpose. Mail forwarding, a shared mailbox, delegated access, and a data export are different controls with different privacy and operational effects.

Microsoft’s current administrator guidance includes preserving mailbox content, forwarding or converting the mailbox where appropriate, assigning another employee access to OneDrive and Outlook data, and handling the license and user account only after those decisions. Retention behavior can change with licensing, tenant settings, and Microsoft policy, so verify it in the current tenant rather than relying on an old checklist.

Move enduring team files out of a personal OneDrive and into an appropriately owned SharePoint or shared business location. Review existing sharing links and permissions instead of assuming they remain correct after a transfer.

04

Transfer work, not every artifact

The business successor usually needs active project files, customer correspondence, calendar context, operational records, and ownership of recurring work. They may not need unrestricted access to every item the employee ever stored.

Document decisions for:

  • Active projects and client records
  • Shared files owned from the user’s OneDrive
  • Microsoft Forms, Power Automate flows, Power Apps, Planner plans, and Teams ownership
  • Recurring meetings and calendar resources
  • Vendor portals and billing contacts
  • Mobile phone numbers or shared business communications

Apply any legal hold or retention requirement before destructive action. Do not improvise legal preservation rules inside the IT process.

05

Recover licenses only after continuity is verified

Removing a license is an accounting action with technical consequences. Confirm that required mailbox and OneDrive handling is complete, successor access works, and any preservation instruction is satisfied before reclaiming it.

Test the result as the successor—not only as a global administrator. Can the right person find the active files, receive the necessary messages, join the relevant Teams, administer the required vendor account, and explain what remains pending?

06

Close the loop

Record:

  • Effective time and approving owner
  • Access revoked and sessions invalidated
  • Devices returned, retired, or still outstanding
  • Mailbox and file disposition
  • Groups, Teams, apps, vendors, and automations transferred
  • Licenses removed or reassigned
  • Exceptions, preservation requirements, and follow-up dates

A reliable offboarding record protects the company and makes the next onboarding process better. Tyler’s Tech Company provides Microsoft 365 management and managed IT services for Greater Boston small businesses that need repeatable user-lifecycle administration.

07

Official sources