C. Evan Solutions · Call (508) 468-8329

Microsoft 365 Offboarding Checklist for a Small Business

When an employee leaves, disabling one email account is not the whole job. The person may also have access to shared mailboxes, Teams, SharePoint, OneDrive, company devices, third-party applications, saved credentials, and vendor portals.

A good offboarding process does three things in the right order: ends access at the approved time, preserves the business records that still need an owner, and documents what was changed. This checklist helps a small-business owner, office manager, or administrator coordinate a normal departure without assuming that every Microsoft 365 tenant is configured the same way.

If access needs to end urgently or the departure requires special handling, use the authorized management and HR process to agree the cutoff and who needs to know. Urgency alone does not establish that an account has been compromised. If unauthorized access is suspected, also follow the organization’s incident response plan and involve its designated security contacts.

For technical help, submit an IT support request or call (508) 468-8329. A web request is not confirmation that work has been accepted or that an immediate response is available. Do not include passwords, recovery codes or confidential employee details in a general inquiry.

The five questions to answer before making changes

  1. What exact date and time should access end?
  2. Who is authorized to approve the change?
  3. Who will own the employee’s email, files, devices, and unfinished work?
  4. Which systems outside Microsoft 365 also need attention?
  5. Who will verify the result and retain the completion record?

If those answers are unclear, even correctly executed technical steps can leave the business without needed email, files, customer context, or control of an important vendor account.

1. Confirm authorization, timing, and business ownership

Record the approved cutoff time, the manager or HR owner, the person performing the changes, and an independent verifier. Use a precise time instead of "Friday afternoon."

Before changing the account, assign an owner for:

  • incoming email and calendar commitments;
  • OneDrive and SharePoint files;
  • Teams, groups, shared mailboxes, and distribution lists;
  • company devices;
  • automated flows, forms, reports, and integrations;
  • customer, vendor, finance, website, and line-of-business accounts.

The business—not the technician—must decide what records should be retained, who may access them, and whether legal, HR, contractual, or regulatory review is needed.

2. Block Microsoft 365 access at the approved time

Use an appropriately authorized administrator account. Do not ask the departing employee for a password.

First confirm whether the identity is cloud-only or synchronized from an on-premises Active Directory environment. A hybrid account needs a coordinated plan for the controlling directory and cloud services; do not assume a cloud-only change ends access to on-premises systems. Microsoft’s linked revocation guidance separates those environments.

For a Microsoft Entra cloud account, the technical sequence may include:

  • resetting the account password;
  • blocking sign-in or disabling the account;
  • revoking Microsoft Entra sign-in sessions;
  • reviewing authentication methods, registered devices, app passwords, and delegated administrative roles;
  • addressing organization data on managed phones, tablets, and computers.

These controls are related, not interchangeable. Microsoft explains that access loss can vary by token, application, device, and synchronization timing. A third-party application may maintain its own session and require a separate sign-out or deprovisioning step. Do not present one button as ending every session everywhere at the same time.

Microsoft’s current former-employee guidance and Entra access-revocation guidance describe the supported Microsoft controls and their limits.

3. Preserve email, files, and active work before deletion

Decide what should happen to new email and existing mailbox content. Depending on the business need and tenant configuration, the approved plan might use delegated access, an automatic reply, forwarding, or conversion to a shared mailbox. Those choices have different privacy, licensing, storage, and workflow effects.

Microsoft warns that a user account used to anchor forwarding or a converted shared mailbox should not simply be deleted. Verify the real mailbox state and licensing requirements before removing a license or deleting an account. See Microsoft’s mailbox handoff guidance.

Review and assign ownership for:

  • mailbox content, contacts, calendars, and meetings;
  • OneDrive files and sharing links;
  • SharePoint sites, libraries, lists, and permissions;
  • Teams memberships, channels, recordings, and shared work;
  • Forms, Power Automate flows, Power Apps, and scheduled processes;
  • groups, shared mailboxes, distribution lists, and delegated access.

Do not rely on a remembered "30-day rule." OneDrive deletion and retention can change based on tenant settings, licensing, account state, retention policies, holds, and delegated ownership. Microsoft’s current OneDrive retention and deletion guidance should be checked against the tenant before any destructive step.

Removing a OneDrive license is not a preservation plan. Unlicensed accounts can enter read-only, archival or deletion processes depending on current account, tenant, retention and billing conditions. Review Microsoft’s unlicensed OneDrive guidance before a license change, and confirm that the approved records owner can actually retrieve the required files. Do not assume that keeping the user account or recording a retention setting guarantees indefinite access. This review does not authorize paid archive activation or a data move.

4. Remove access outside Microsoft 365

Microsoft 365 is often the front door to other systems, but it is rarely the only door. Check the systems the employee actually used, including:

  • password managers and shared vaults;
  • accounting, payroll, banking, and expense tools;
  • CRM, ticketing, scheduling, and line-of-business applications;
  • website, hosting, domain, analytics, advertising, and social accounts;
  • vendor, distributor, insurance, and customer portals;
  • VPN, remote support, cameras, access control, and alarm systems;
  • personal recovery email addresses or phone numbers attached to business accounts.

Rotate shared credentials where necessary and replace shared access with named accounts when the system supports it. Review integrations owned by the departing account: disabling one identity can also stop a scanner, form, scheduled report, workflow, or synchronization.

Handle personal phones without confusing access removal and erasure

Before touching a personal phone, agree on the intended result. Is the person leaving the business, changing roles, or only replacing a device? Those are different access decisions. An administrator’s ability to issue a command is not permission to erase someone’s personal data.

For a Boston-area team using personal phones for work, record four things:

  • Who owns the device, and which business account and apps are in scope?
  • Should company access end everywhere, or only change on this device?
  • Which approved business records must remain available to a new owner?
  • What evidence will confirm the requested action, and who owns any exception?

Blocking a work account does not erase files already downloaded to a device. Microsoft notes that an offline device may still have locally stored data. Keep account access and device-data handling as separate checks; do not promise that a sign-in change removes every copy. See Microsoft’s access-revocation limits.

Where the required Intune app protection, licensing and supported apps are already in place, an administrator may be able to remove company data from managed apps without resetting the entire phone. Do not assume every personal device has that capability. A selective-wipe request can be pending or failed; Microsoft says the user must open the app for the wipe to occur. Check the result for each protected app rather than treating a submitted request as a completed offboarding. See Microsoft’s managed-app data removal guidance.

A full device wipe is a different, potentially destructive operation; its behavior depends on the platform and selected options. Do not factory-reset a personal phone as a routine shortcut. Confirm ownership, written authorization, the exact action and the approved preservation plan first. If the device cannot be reached or the result cannot be verified, leave that item open with an owner and next step. That exception is more useful than an unsupported "all access removed."

5. Verify the result with a second person

The implementer should capture evidence of the approved actions. A manager or second administrator should then confirm the business handoff and the technical result.

Verify that:

  • the account cannot obtain a new Microsoft 365 sign-in;
  • Microsoft Entra session revocation was requested and separately issued application sessions were addressed where applicable;
  • required email, files, and active work are available to the named owner;
  • groups, Teams, sites, mailboxes, and roles no longer grant inappropriate access;
  • company devices and relevant third-party systems were addressed;
  • customer-facing and automated processes still work;
  • exceptions have a named owner, reason, and due date;
  • the approver, implementer, verifier, actions, and completion time are documented.

Verification should prove the work that was actually in scope. It is not a certification that every possible account, device, or application has been found.

Copyable Microsoft 365 offboarding checklist

Authorization and timing

  • ☐ Exact access cutoff date and time confirmed.
  • ☐ Authorized manager or HR owner recorded.
  • ☐ Normal, urgent, or suspected-compromise path selected.
  • ☐ Implementer and independent verifier assigned.

Microsoft 365 access

  • ☐ Password reset completed at the approved time, if required.
  • ☐ Sign-in blocked or account disabled.
  • ☐ Microsoft Entra sessions revoked.
  • ☐ Authentication methods, devices, app passwords, and roles reviewed.
  • ☐ Mail, mobile, and delegated access addressed where applicable.

Business records and ownership

  • ☐ Mailbox, calendar, contacts, meetings, and active work assigned.
  • ☐ OneDrive and SharePoint content reviewed and transferred as approved.
  • ☐ Teams, groups, shared mailboxes, and distribution lists reviewed.
  • ☐ Forms, flows, apps, and scheduled processes assigned.
  • ☐ Retention or legal decisions confirmed by the appropriate business adviser.

Devices and other systems

  • ☐ Company laptop, phone, tablet, keys, and access devices addressed.
  • ☐ Personal-device ownership, authorized action and per-app or device result recorded; pending or unverified removal retained as an open exception.
  • ☐ Password manager, finance, CRM, vendor, website, social, VPN, camera, and business applications reviewed.
  • ☐ Shared credentials rotated and personal recovery methods removed where authorized.
  • ☐ License removal and account deletion deferred until preservation and dependency checks are complete.

Closeout

  • ☐ New owners can open the retained records and perform the actual work.
  • ☐ Access controls were independently checked without claiming universal immediate access loss.
  • ☐ Exceptions have an owner and due date.
  • ☐ Evidence and completion time were recorded.

Make the next departure easier

Pair this checklist with onboarding. Every account, device, role, group, shared credential, and business process created for a new hire should have a matching removal or ownership-transfer step.

C. Evan Solutions provides Microsoft 365 support for small businesses and practical Boston-area IT support for Massachusetts teams. Real IT support without the contract lock-in.

For a planned departure or a repeatable offboarding process, request an offboarding and access review. For broader planning, book a practical consultation. Or call (508) 468-8329.