Microsoft 365 offboarding checklist: what to do when an employee leaves
When someone leaves, agree when their access should end and who will take over their work. Have your IT administrator secure access at the agreed time, then check that the business can still reach the email and files it needs before changing licences or deleting accounts.
For a planned departure, prepare the handover beforehand. If access needs to end urgently, ask your IT support to act promptly. An unfinished handover should not delay securing the account.
This Microsoft 365 offboarding checklist is for small-business owners and office managers coordinating the process with their IT support. The account changes should be carried out by an authorised administrator using Microsoft’s current leaver guidance.
1. Agree the leaving time and the people responsible
Start with a short record: the employee, their last working time, who approves the changes and who will carry them out. Include who takes over customer work and who can decide what information must be retained.
Imagine an office administrator who handles incoming enquiries, prepares quotes and maintains a weekly reminder. Their replacement may need three different things: access to customer correspondence, the current quote files and responsibility for the reminder. “Close the account on Friday” leaves those decisions unanswered.
Ask the departing colleague to identify important work while they are still available, where appropriate. Confirm the plan with the manager and IT support so nobody has to guess the timing.
2. Remove access at the agreed time
Ask the administrator to follow the appropriate process for blocking sign-in, resetting the password and ending existing sessions. These are separate actions, and Microsoft warns that sign-out and blocking changes may not take effect everywhere immediately. A tick beside “password changed” is not enough evidence that the departure is complete.
The administrator should also review privileged access, such as administrator roles, and any shared credentials the person knew. Your business may have other accounts that need separate action.
Record what was done, when it was done and any access that still needs checking. Microsoft’s access-removal instructions explain the technical steps and timing limitations.
3. Decide who needs the email, and for how long
Separate two questions: who needs past correspondence, and what should happen to new messages? Agree an authorised recipient, a suitable automatic reply or other handling, and a review date. Give access only where the business needs it, following your organisation’s policies.
A shared mailbox may be appropriate when colleagues need ongoing access. If the administrator converts the existing mailbox, they must check the conversion before removing its licence. The underlying account must remain, and its sign-in still needs securing. Mailbox size, archiving and retention features can affect licensing; conversion is not a universal free-storage option. Microsoft’s conversion guidance sets out those conditions.
Avoid handing the former employee’s password to a colleague. Use the replacement’s own account and agreed permissions. Check the chosen mail-handling arrangement with a test message and make sure someone knows they are responsible for replies.
4. Hand over the files and the work around them
Identify the documents the business needs, their actual location and their next owner. A link in Teams or an email does not tell you whether the file lives in someone’s OneDrive or a shared SharePoint library.
For ongoing team documents, agree an appropriate shared home and access. Our OneDrive vs SharePoint guide explains that choice. Have the administrator check the transfer method where links or version history matter, then ask the replacement to open the files from their own account.
Check related responsibilities too: ownership of a Team or site, customer forms and any automated reminders. For Power Automate, another owner alone may not solve the problem if a flow still uses the departing person’s connections. Microsoft’s flow-sharing guidance explains that dependency.
In the office-administrator example, the replacement should open a current quote and confirm the reminder still works. Seeing a folder name is a weaker check than using the work inside it.
5. Account for devices and other business apps
List the company laptop, phone, security keys and other equipment to return. Include separately managed services such as your CRM, accounts software, website and supplier portals. Each needs an owner to confirm the appropriate access change.
Blocking Microsoft 365 access does not remove files already downloaded to an unmanaged personal device. Microsoft highlights this limitation. Ask IT what your device-management setup can actually do, particularly where personal devices have been used for work.
Any device action should fit its ownership, the management tools in place and your policies. Record returned equipment and unresolved items rather than assuming an account change has dealt with everything.
6. Final checks for your Microsoft 365 offboarding checklist
Use a simple completion record for each part of the handover:
Access: the named administrator records the actions and any remaining checks.
Email: the agreed person can handle messages using their own access.
Files and work: the replacement can open needed documents and use the processes they now own.
Devices and other apps: returns and access changes are confirmed, or have an owner and due date.
Retained information: its purpose, authorised access and review date are recorded.
Then ask IT to review licences and account deletion against the agreed retention requirements, any holds and the mailbox setup. Removing a licence and deleting an account have different consequences. OneDrive also has specific rules for unlicensed accounts, so leaving an account in place does not guarantee its files will remain normally accessible indefinitely.
Do not rely on one assumed retention period for everything. Have the administrator confirm the applicable settings before changes. Also check subscription commitments: unassigning a licence does not necessarily reduce the bill immediately.
Make the next departure easier to manage
Keep the agreed checklist with your normal joiner and leaver process. Give each action a named owner, a due time and a way to confirm it worked.
Cache4’s Managed Security & Support includes user onboarding and offboarding alongside day-to-day Microsoft 365 management. We can talk through your current process and agree what support your business needs.
Book a free 30-minute Discovery Call with Paul Crooks. Bring the checklist you currently use, or an example of a handover that left your team searching for information. We’ll discuss your setup and whether we can help, with no pressure or obligation.
Comments