Microsoft 365 Offboarding Checklist for IT Admins
When an employee leaves, the technical steps often happen quickly.
Disable the account. Remove the licence. Collect the laptop. Move on.
That sounds fine until something gets missed.
Maybe the user still has access through a mobile device. Maybe their OneDrive holds important business files. Maybe their mailbox is still needed. Maybe shared browser sessions or old permissions leave a security gap behind.
That is why offboarding needs to be treated as a repeatable process, not a last-minute admin task.
This Microsoft 365 offboarding checklist is designed to help IT admins remove access safely, protect data properly, and reduce operational risk when employees leave.
Quick summary
A strong Microsoft 365 offboarding process should cover:
- account access
- licence removal
- mailbox and OneDrive review
- Teams, SharePoint, and group access
- device and browser clean-up
- retention and compliance requirements
- documentation of the actions taken
If any of those are skipped, the risk usually shows up later.
Why Microsoft 365 offboarding matters
Poor offboarding creates two problems at the same time.
First, it creates security risk. Former employees may still have access through cached sessions, unmanaged devices, shared links, or missed group permissions.
Second, it creates data risk. Important files, emails, chats, or records may be lost before the organisation has decided what should happen to them.
That is why offboarding should never be reduced to “disable user and remove licence”.
It needs a checklist.
Microsoft 365 Offboarding Checklist
1. Block sign-in immediately
The first priority is to prevent further access.
As soon as an employee leaves, sign-in should be blocked so they can no longer access Microsoft 365 services.
This includes access to:
- Outlook
- Teams
- SharePoint
- OneDrive
- mobile apps
- browser sessions on unmanaged devices
This is the fastest way to reduce immediate risk.
2. Review admin roles and privileged access
Before going further, confirm whether the user holds any elevated permissions.
Check for:
- Microsoft 365 admin roles
- Entra ID roles
- SharePoint admin access
- Teams admin permissions
- Power Platform roles
- access to shared service accounts
Privileged access should always be reviewed early in the process, because the security impact is higher if it is missed.
3. Reset sessions and review devices
Blocking sign-in is important, but it is not the whole story.
Users may still have active sessions on browsers, mobile devices, or managed endpoints. Microsoft 365 environments should include device and session review as part of the leaver process, especially where shared or lightly managed devices are involved.
If browser-based access is part of the risk, it also makes sense to review why clearing browser history matters for Microsoft 365 security, because old sessions and cached data can leave access traces behind.
4. Review mailbox requirements
Before deleting or de-licensing anything, decide what needs to happen to the mailbox.
Questions to ask include:
- Does the mailbox need to be retained?
- Does another user need access?
- Are there compliance or legal reasons to preserve it?
- Should an automatic reply or forwarding rule be configured temporarily?
This decision should be made deliberately, not left until after the licence is removed.
5. Review OneDrive and business files
This is one of the most commonly missed steps.
Employees often store working documents, handover notes, exports, spreadsheets, and drafts in OneDrive. If the licence is removed or the account is deleted too early, that data may become difficult to recover.
Before changing the account, confirm:
- whether the files are still needed
- whether the manager needs access
- whether key documents should be moved to SharePoint or Teams
- whether retention or archive requirements apply
If this is a common issue in your environment, also see how to manage unlicensed OneDrive accounts in Microsoft 365.
6. Remove or reassign licences carefully
Licence removal should happen after the data and access decisions are clear.
That matters because licence changes can affect:
- mailbox behaviour
- OneDrive retention
- archive options
- service access
- compliance handling
Removing a licence too early is one of the easiest ways to create avoidable problems.
7. Review group membership and shared access
Most leaver risk sits in shared access that nobody remembers.
Review the user’s access to:
- Microsoft Teams
- Microsoft 365 Groups
- SharePoint sites
- distribution lists
- shared mailboxes
- Power Platform environments
- third-party applications connected through Entra ID
This is the step that stops former users remaining quietly tied to active business areas.
8. Check mobile devices and endpoint management
If the user had a company-managed phone, tablet, or laptop, make sure those devices are accounted for and reviewed.
Where Microsoft Intune or endpoint management is in place, confirm the device status and apply the right actions for wipe, retire, or reassignment.
This is not just an HR checklist item. It is part of securing access properly.
9. Apply retention and compliance decisions
Not every departing user should be treated the same way.
Some data can be deleted quickly. Some must be retained. Some may need longer-term archiving.
Microsoft 365 retention and lifecycle decisions should be based on business need, risk, and compliance requirements. Teams working at admin level often build this capability through structured Microsoft 365 Administrator training, especially where retention, Purview, identity, and tenant controls overlap.
10. Document what was done
This step gets skipped more often than it should.
Document:
- when access was blocked
- when licences were removed
- who approved the retention decision
- what happened to mailbox and OneDrive data
- what device actions were taken
- whether any follow-up is still required
Good documentation turns offboarding from a one-off reaction into a defensible process.
Common Microsoft 365 offboarding mistakes
The same problems come up repeatedly:
- removing the licence before reviewing OneDrive
- forgetting to review group membership
- assuming sign-out means all sessions are closed
- missing admin roles or elevated access
- relying on memory instead of a checklist
- failing to document the decision-making
Most of these are process problems, not technology problems.
A better way to think about offboarding
Good offboarding is not just about removing a user.
It is about closing access, protecting data, preserving what matters, and leaving the environment in a cleaner state than before.
That means security, governance, support, and training all play a part.
If the offboarding process in your organisation still depends on memory, manual work, or last-minute decisions, that is usually a sign the wider Microsoft 365 operational model needs tightening.
Need help improving your Microsoft 365 offboarding process?
If user offboarding is inconsistent, rushed, or creating avoidable risk, our Microsoft 365 Support service can help you put a cleaner process in place.
We help organisations improve day-to-day control across:
- user lifecycle management
- Microsoft 365 administration
- permissions and access
- retention and data handling
- operational governance
- ongoing support for Microsoft 365 environments
If you want to build stronger internal admin capability at the same time, structured Microsoft 365 Administrator training can help your team handle these processes with more confidence.
Frequently Asked Questions
What is Microsoft 365 offboarding?
Microsoft 365 offboarding is the process of removing a departing user’s access, reviewing their data, handling licences correctly, and making sure security, compliance, and operational steps are completed.
When should a Microsoft 365 licence be removed?
Usually after the organisation has reviewed mailbox, OneDrive, retention, and access requirements. Removing it too early can create avoidable problems.
What should happen to a user’s OneDrive when they leave?
That depends on whether the data is still needed, whether retention rules apply, and whether the account will be deleted, retained, or archived. It should never be left to chance.
Is blocking sign-in enough on its own?
No. Sign-in blocking is the first step, but admins should also review sessions, devices, roles, group membership, and retained data.
Why do organisations need an offboarding checklist?
Because offboarding errors are usually caused by missed steps, not missing technology. A checklist makes the process repeatable and lowers risk.