Microsoft 365 Employee Offboarding

1. Put a name and a time on the handoff

HR or the authorized manager should confirm when access must end, who may receive the departing employee's business information, and whether any preservation requirement changes the plan. IT needs the effective time before the farewell email becomes the access-control system.

Assign one coordinator. Give that person a list of systems and named owners, including applications outside Microsoft 365. Have the manager identify customer commitments and work that must continue. An organization chart is a starting point, not an inventory of everything a person operated.

• Effective departure time and authorized approver
• IT coordinator and a backup contact
• Successor for customer communication and active work
• Devices, applications, shared credentials, and administrative roles
• Data-preservation decisions and a date to review remaining access

2. Close access across the places it actually exists

Have IT block new sign-ins and revoke sessions, then check connected applications and managed devices. Microsoft explains that access revocation can involve delays and that applications can maintain their own sessions. One successful action in an admin portal is not proof that every application has ended access.

Ask for a documented result for your environment, including any local directory synchronization. Separately review VPNs, password managers, phone systems, vendor portals, and business tools that use their own logins. Rotate shared secrets the person knew where appropriate, and verify replacement access before disrupting an operational dependency.

Collect company equipment and apply the approved device-management process. Have IT distinguish company data removal from a full device wipe, especially on personally owned equipment. The manager should receive confirmation of completion and any remaining exposure, rather than a vague assurance that the account is handled.

3. Decide what happens to customer email before changing the license

Choose who will handle new messages and whether approved staff need historical email. Forwarding and a shared mailbox solve different needs; neither should become a permanent dumping ground for conversations nobody owns. Define who monitors the address and when the arrangement will be reviewed.

Microsoft's shared-mailbox guidance says to perform conversion while the user mailbox is licensed and retain its associated account. Conversion does not by itself block sign-in, and existing inbox rules remain. Have IT verify those controls and the mailbox's licensing requirements, including size, archiving, and hold features, before reclaiming a license.

Test the chosen handoff with the successor. Check delegated access, mail routing, existing forwarding rules, recurring meetings, and room bookings. Do not give the successor the former employee's password. Use approved permissions with an accountable owner.

4. Move working files into business ownership

Ask the manager to identify the files that keep current work moving: proposals, pricing models, project documents, and the spreadsheet everyone mysteriously depends on. Transfer approved business material to an appropriate team location, then verify that the successor can open and use it.

Microsoft documents configurable OneDrive retention after account deletion, along with separate handling for unlicensed accounts. Removing a license and deleting an account are different events. Do not rely on an assumed grace period or expect an unlicensed OneDrive to remain a convenient permanent archive.

Have the administrator confirm the tenant's actual settings, access delegation, and any retention or hold requirements. Verify sharing links and shortcuts after the move. A folder named Handoff is not evidence that the people who need its contents can work with them.

5. Check the work that runs under the person's identity

Email and files are visible. The less obvious dependency is the approval, report, integration, or automation that was built under one person's account. Ask your technical team to inventory the workflows that person owned and test the critical ones under the intended successor or approved operational identity.

Review ownership of Teams, shared workspaces, forms, dashboards, scheduled jobs, and third-party integrations as applicable. Assign responsibility for credentials and connections as well as the visible workflow. Changing a display name in an owner field may not update the connection doing the actual work.

Start with a real transaction: can the next invoice be approved, the next customer request routed, and the next report delivered? A simple workflow test can find a dependency that a long account inventory misses. Record exceptions and give each one a person and a deadline.

6. Finish with evidence, then reclaim what is no longer needed

Before account deletion or license removal, have IT confirm that the preservation and handoff steps are complete and that the proposed cleanup fits the selected configuration. Microsoft treats protecting access, preserving data, transferring work, and removing accounts as separate parts of offboarding. A single checkbox is doing too much work.

Keep a concise completion record with timestamps, owners, verified results, and outstanding issues. Set an expiry or review date for temporary mailbox access and forwarding. Have the manager confirm that customer work continues and IT confirm that remaining access is intentional.