Employee Offboarding: Close Access, Keep Work Moving

When someone leaves, two things have to happen. Their access has to end at the time you've authorized, and their customers shouldn't be left waiting on work nobody owns. Think of a departure as a business handover with a security deadline. Deleting an email account is only one small piece of it.

Try this test on your last departure: could HR, the manager, and IT each show you what they did, and show that no handoff got dropped? The checklist below is a way to find out before the next staff or contractor change.

Agree on the Cutoff Before You Change Anything

Ask the authorized HR or business lead to confirm the departure time, time zone, scope, and who is coordinating. Keep sensitive employment details out of support tickets that lots of people can see.

Split the responsibilities:

• HR or leadership: authorizes the timing and handles changes to the plan.
• The manager: lists active work and names who takes it over.
• IT: coordinates account, device, and access changes.
• Application owners: confirm completion in systems outside the central IT account.

If the departure is urgent, contain access first. Don't hold that up while you wait for a perfect handover inventory. Track the unfinished transfer work on its own.

Check More Than the Microsoft 365 Account

Microsoft distinguishes between blocking new sign-ins and revoking sessions, and notes that Entra ID can't directly revoke a session token issued by another application. Disabling one account won't necessarily close every door.

Have IT review the person's actual footprint:

• Business email, collaboration, and remote access
• Finance, customer-management, scheduling, and industry-specific applications
• Password-vault membership and any shared credentials they knew
• Vendor portals, website administration, and recovery contacts
• Privileged accounts, including any held under a different username

Get a completion note from each responsible owner. If a shared secret has to change, coordinate with its owner and test the workflow that depends on it. Rotating it blindly can break something on a Monday morning.

Preserve the Work Without Sharing the Old Login

Microsoft's guidance on removing a former employee treats keeping mailbox content, arranging email continuity, and giving someone access to OneDrive and Outlook data as separate tasks, and suggests thinking about that access before you delete the account.

Before cleaning up accounts or licences, have the manager and IT agree on which business records to keep, who may receive them, and for how long. If there's a legal or records question, get it answered before anything is deleted.

A short handover list helps:

• Open customer requests, and what was promised next
• Proposals, project files, and upcoming appointments
• Shared workspaces that need a new owner
• Recurring reports, integrations, or automations to check
• Vendor and renewal responsibilities to reassign

Give successors access through their own approved accounts. Don't pass around the departing employee's password, and don't make full mailbox access the default. Ask each successor to confirm they can reach the specific work they're taking on.

Treat Equipment Return Separately

Note who will collect company equipment, when it's due, and how receipt gets confirmed. For remote staff, agree the return method before the last day if you can.

Don't mark data removal as done just because someone sent a remote wipe. Microsoft notes that its device and managed-app wipes need an internet connection to trigger, so an offline device may still hold local data.

For personal devices, have IT confirm who owns the device, how it's managed, and what is authorized before anything is removed. A device you can't reach, or a wipe you can't confirm, stays on the list as an open exception.

Close the Ticket With Evidence

Ask for a short completion summary covering:

• The authorized cutoff, and the access-removal actions taken
• Confirmations from application owners, and any access exceptions still open
• Business records kept, and whether each handoff owner accepted
• Equipment received, or a named owner for follow-up
• Account and licence cleanup decisions that were approved

Leave credentials and unneeded mailbox contents out of that summary. If something is unresolved, note the business impact, the interim control, the owner, and when you'll look again.

A good first step: pick one recent departure and walk through it with the manager and IT. You're looking for missing confirmations, not someone to blame, and what you find will improve the next handover.

Related Reading

Our Microsoft 365 security baseline covers ongoing identity, device, and admin controls. This post is about one time-sensitive event: ending a person's access across your systems while their work moves to someone else.