The employee leaves Friday. Their work should not disappear Monday.
An employee departure can look like a simple IT ticket: disable the account, recover the laptop, reclaim the license. Then a customer asks about a proposal, a shared spreadsheet stops opening, and an automated approval waits patiently for someone who no longer works here.
That is a handoff problem with a technology component. The business needs to close access while keeping the right information and work moving. Neither goal is served by an enthusiastic click on Delete User.
As you review fourth-quarter staffing and cloud spending, make employee offboarding a repeatable business process. The checklist below is for the owner approving the outcome. Your administrator should choose the technical steps for your tenant, identity setup, and data obligations.
1. Put a name and a time on the handoff
HR or the authorized manager should confirm when access must end, who may receive the departing employee's business information, and whether any preservation requirement changes the plan. IT needs the effective time before the farewell email becomes the access-control system.
Assign one coordinator. Give that person a list of systems and named owners, including applications outside Microsoft 365. Have the manager identify customer commitments and work that must continue. An organization chart is a starting point, not an inventory of everything a person operated.
- Effective departure time and authorized approver
- IT coordinator and a backup contact
- Successor for customer communication and active work
- Devices, applications, shared credentials, and administrative roles
- Data-preservation decisions and a date to review remaining access
2. Close access across the places it actually exists
Have IT block new sign-ins and revoke sessions, then check connected applications and managed devices. Microsoft explains that access revocation can involve delays and that applications can maintain their own sessions. One successful action in an admin portal is not proof that every application has ended access.
Ask for a documented result for your environment, including any local directory synchronization. Separately review VPNs, password managers, phone systems, vendor portals, and business tools that use their own logins. Rotate shared secrets the person knew where appropriate, and verify replacement access before disrupting an operational dependency.
Collect company equipment and apply the approved device-management process. Have IT distinguish company data removal from a full device wipe, especially on personally owned equipment. The manager should receive confirmation of completion and any remaining exposure, rather than a vague assurance that the account is handled.
Microsoft: how access revocation and application sessions work
3. Decide what happens to customer email before changing the license
Choose who will handle new messages and whether approved staff need historical email. Forwarding and a shared mailbox solve different needs; neither should become a permanent dumping ground for conversations nobody owns. Define who monitors the address and when the arrangement will be reviewed.
Microsoft's shared-mailbox guidance says to perform conversion while the user mailbox is licensed and retain its associated account. Conversion does not by itself block sign-in, and existing inbox rules remain. Have IT verify those controls and the mailbox's licensing requirements, including size, archiving, and hold features, before reclaiming a license.
Test the chosen handoff with the successor. Check delegated access, mail routing, existing forwarding rules, recurring meetings, and room bookings. Do not give the successor the former employee's password. Use approved permissions with an accountable owner.
4. Move working files into business ownership
Ask the manager to identify the files that keep current work moving: proposals, pricing models, project documents, and the spreadsheet everyone mysteriously depends on. Transfer approved business material to an appropriate team location, then verify that the successor can open and use it.
Microsoft documents configurable OneDrive retention after account deletion, along with separate handling for unlicensed accounts. Removing a license and deleting an account are different events. Do not rely on an assumed grace period or expect an unlicensed OneDrive to remain a convenient permanent archive.
Have the administrator confirm the tenant's actual settings, access delegation, and any retention or hold requirements. Verify sharing links and shortcuts after the move. A folder named Handoff is not evidence that the people who need its contents can work with them.
Microsoft: OneDrive retention, access delegation, and deletion
5. Check the work that runs under the person's identity
Email and files are visible. The less obvious dependency is the approval, report, integration, or automation that was built under one person's account. Ask your technical team to inventory the workflows that person owned and test the critical ones under the intended successor or approved operational identity.
Review ownership of Teams, shared workspaces, forms, dashboards, scheduled jobs, and third-party integrations as applicable. Assign responsibility for credentials and connections as well as the visible workflow. Changing a display name in an owner field may not update the connection doing the actual work.
Start with a real transaction: can the next invoice be approved, the next customer request routed, and the next report delivered? A simple workflow test can find a dependency that a long account inventory misses. Record exceptions and give each one a person and a deadline.
6. Finish with evidence, then reclaim what is no longer needed
Before account deletion or license removal, have IT confirm that the preservation and handoff steps are complete and that the proposed cleanup fits the selected configuration. Microsoft treats protecting access, preserving data, transferring work, and removing accounts as separate parts of offboarding. A single checkbox is doing too much work.
Keep a concise completion record with timestamps, owners, verified results, and outstanding issues. Set an expiry or review date for temporary mailbox access and forwarding. Have the manager confirm that customer work continues and IT confirm that remaining access is intentional.
Comnexiom helps businesses connect cloud administration, support, security, and technology planning. A sensible first step is to walk through your most recent departure with the manager and IT provider. Ask what was closed, what was handed over, and what was actually tested. If the answer lives in three inboxes and someone's memory, you have found a useful improvement project.
COMMON QUESTIONS
Questions business leaders ask about cloud & microsoft 365
Is blocking Microsoft 365 sign-in enough to finish offboarding?
No. Revoke sessions, review application and device access, and verify email, file, and workflow handoffs. Connected applications may have separate sessions or credentials that require their own action.
Should we delete the employee account immediately?
Decide preservation, mailbox handling, file transfer, and workflow ownership first. Some configurations, including a converted shared mailbox, require the associated account to remain. Have the administrator verify the correct sequence.
Does converting a mailbox to shared automatically block the former employee?
No. Sign-in controls must be addressed separately. The administrator should also review retained inbox rules, delegated access, and the shared mailbox's licensing requirements.
Can we remove a license and leave files in OneDrive indefinitely?
Do not assume that. Unlicensed-account handling and account-deletion retention are different processes. Confirm current tenant settings and move necessary business files into an approved location with a named owner.
What evidence should a business owner receive?
A completion record should identify access actions and timestamps, owners for email and files, successful checks of critical workflows, unresolved exceptions, and review dates for temporary arrangements.