Offboarding is an identity-security event
When an employee or contractor leaves, a Central Florida business must preserve needed records while ending access at the right time. In Microsoft 365, clicking **Block sign-in** is important, but it does not automatically settle every session, application, device, forwarding rule, delegated permission, shared credential, or third-party service.
Microsoft's own guidance treats offboarding as a sequence: prevent sign-in, preserve or transfer business data, address mobile devices, manage mailbox and OneDrive access, and remove the account when appropriate. Microsoft Entra guidance also explains that access revocation timing depends on token and application behavior. An application that issued its own session cookie may continue to control that session until it expires or the application revokes it.
That means a reliable process needs coordination between management, human resources, IT, legal or compliance, and application owners. It also needs evidence. A completed ticket saying “user disabled” is weaker than a record showing which access paths were checked, who performed each action, and what exceptions remain.
This article provides a planning checklist, not a one-click script. Test the process in your environment and adapt it to contracts, retention requirements, employment practices, and legal advice.
Before the departure time
For a planned departure, assemble the minimum information without broadly disclosing sensitive personnel details:
- Employee or contractor name, primary account, aliases, and departure time.
- Manager, HR contact, IT owner, and approving authority.
- Whether the separation is routine, urgent, or higher risk.
- Assigned laptop, phone, tablet, security keys, badges, and removable media.
- Microsoft 365 roles, group memberships, shared mailboxes, Teams, sites, and distribution lists.
- Business applications that use Microsoft Entra single sign-on.
- Applications with separate passwords or their own sessions.
- Service accounts, automation, API credentials, certificates, or shared secrets known to the user.
- Mailbox, OneDrive, SharePoint, Teams, and device data that must be retained or transferred.
- Legal holds, records schedules, customer obligations, or active investigations.
Use a need-to-know process. Do not place unnecessary personnel allegations, passwords, private keys, or recovery codes in the offboarding ticket.
At the approved cutoff time
1. Block the account and revoke sessions
Use an administrator with the least privilege needed for the task. For a standard user, Microsoft documents appropriate administrative roles; more privilege may be needed when offboarding another administrator.
The access response should generally address:
- Account sign-in status.
- Password or authentication methods where the approved procedure requires action.
- Microsoft Entra refresh tokens and sign-in sessions.
- Registered or managed devices.
- Privileged roles and eligible role assignments.
- Temporary access passes, app passwords, certificates, security keys, and other authentication methods.
Microsoft notes that revoking refresh tokens prevents the user from obtaining new access through those tokens, but existing access tokens or application-issued sessions may persist until expiration or application-side revocation. Continuous Access Evaluation can shorten the window for supported applications and events, but it has scope and limitations.
Record the time each action was initiated and the result. If immediate revocation is important, do not assume that a single checkbox took effect everywhere at once.
2. Check applications beyond Microsoft 365
Review every application associated with the person. Separate them into three groups:
1. Applications automatically provisioned and deprovisioned through Microsoft Entra.
2. Applications that use Entra sign-in but maintain their own sessions or authorization.
3. Applications with independent accounts, local credentials, API keys, or shared access.
Microsoft recommends automated deprovisioning where supported and a manual process for applications that do not support it. Confirm that application owners remove direct assignments, local accounts, active sessions, tokens, and business roles.
Examples may include payroll, accounting, customer management, banking, electronic health records, construction estimating, engineering platforms, remote support, social media, domain registration, code repositories, and vendor portals.
3. Remove privileged and delegated access
Check more than the user's main account:
- Microsoft Entra and Microsoft 365 administrative roles.
- Exchange mailbox delegation and Send As permissions.
- Shared mailbox, SharePoint, Teams, and private-channel membership.
- Group ownership, application ownership, and enterprise-app assignments.
- Azure subscriptions, resource roles, and DevOps access where used.
- Partner or guest identities in customer and vendor tenants.
- Local administrator accounts and remote-management tools.
Transfer ownership before deletion so business processes, approvals, integrations, and records do not become orphaned. Avoid assigning all former access to a manager by default; the manager should receive only what is required for continuity.
4. Secure devices and local data
Recover company-owned equipment using the organization's established process. For devices managed through Microsoft Intune or another system, determine whether to retire, selectively wipe corporate data, or perform a full wipe. Microsoft warns that an offline device can retain locally stored information until it reconnects, so device recovery and physical control still matter.
Record:
- Asset tag, serial number, custodian, and return condition.
- Management and encryption status.
- Last check-in time.
- Wipe, retire, disable, or quarantine command and result.
- Security keys, badges, removable drives, and paper records returned.
Do not issue a destructive wipe without confirming scope, authorization, data preservation, and whether the device is company-owned.
Preserve and transfer business information
Offboarding should not destroy records that the organization must keep. Before deleting an account or license, determine how the business will preserve and access:
- Mailbox content and calendars.
- OneDrive files and shared links.
- Teams messages, meeting artifacts, and files stored in SharePoint.
- Forms, Power Automate flows, Power Apps, reports, and approvals.
- Documents subject to retention, legal hold, audit, or investigation.
- Customer correspondence and active work.
Microsoft's former-employee guidance includes options for mailbox and OneDrive continuity, and Microsoft Purview may be relevant to retention or legal holds. Exact behavior varies by license, configuration, and retention policy. Verify current Microsoft documentation and obtain legal guidance where required.
Avoid password sharing or logging in as the departed user for routine continuity. Use supported delegation, ownership transfer, retention, and eDiscovery processes.
Look for persistence and business-process risks
A higher-risk or security-related departure may justify additional review. Look for changes that could outlive the primary account:
- Inbox rules, forwarding, delegates, and external sharing.
- Newly registered authentication methods or devices.
- Recent application consents and OAuth grants.
- New accounts, groups, guest users, or role assignments.
- Personal access tokens, API keys, certificates, webhooks, and automation connections.
- Unusual downloads, mailbox access, file sharing, or administrative activity.
- Changes to payment instructions, vendor records, domain settings, or recovery contacts.
Do not interpret every unusual event as misconduct. Preserve logs, document facts, and involve qualified security, HR, legal, or law-enforcement personnel as appropriate.
Verify instead of assuming
After the cutoff, perform a second-person review. Verification can include:
- The account is disabled and not assigned privileged roles.
- Session revocation was completed and recorded.
- Authentication methods and registered devices were handled according to policy.
- Critical third-party applications show the account as disabled or removed.
- Mail forwarding, delegation, external sharing, and app consent were reviewed.
- Company equipment and credentials were returned or remotely addressed.
- Data preservation, transfer, and retention actions have named owners.
- Group, application, workflow, and resource ownership has been reassigned.
- The license and account deletion date are scheduled rather than improvised.
- Remaining exceptions have owners and due dates.
For a sample, have the application owner verify that access is actually denied. Do not test by asking for or using the former employee's password.
A reusable timeline
Before departure
- Approve timing and scope.
- Inventory identities, roles, apps, devices, and data.
- Plan record retention and ownership transfer.
- Prepare application-specific actions and contacts.
At departure
- Block sign-in and revoke Microsoft sessions.
- Remove privileged assignments.
- Disable or deprovision connected applications.
- Recover or secure devices and credentials.
Within the same business day
- Verify critical applications and access paths.
- Review forwarding, delegation, sharing, consent, and recent high-risk changes.
- Confirm data preservation and business continuity.
- Escalate failures or suspicious evidence.
Within seven days
- Complete ownership transfers and remaining manual deprovisioning.
- Review audit evidence and close exceptions.
- Schedule license removal and account deletion according to retention policy.
- Record lessons that should improve the standard process.
Metrics leadership can use
A small business can evaluate the process without collecting excessive personnel data. Useful measures include:
- Percentage of departures communicated before the approved cutoff.
- Time from approved cutoff to sign-in block and session revocation.
- Percentage of critical applications verified the same day.
- Number and age of unresolved access exceptions.
- Percentage of equipment recovered or remotely secured.
- Number of orphaned applications, groups, workflows, or resources found.
The goal is not merely to delete an account. It is to end access predictably, protect business records, preserve continuity, and produce evidence that the process was completed.
Human-reviewed draft. This article provides general information, not legal, employment, compliance, or product-configuration advice.