Set the timing before touching the accounts.

Use this employee IT offboarding checklist with the person authorized to approve access changes. Record the employee, effective time, responsible IT contact, and who should receive ongoing work. For an urgent departure, coordinate the timing directly with the authorized decision-maker.

Business owners also need to identify any records that must be preserved before data or accounts are removed. Make those decisions explicitly. An offboarding ticket should not require a technician to guess what information the business needs or who is allowed to see it.

Keep the checklist in a restricted business system. It can identify accounts and owners, but it should not become a document full of passwords or unnecessary personal information.

The offboarding checklist

  1. Approve the change: Record the authorized request, cutoff time, account list, and contact for questions.
  2. Secure primary access: Block the relevant sign-ins, reset credentials where appropriate, and revoke active sessions. Coordinate any on-premises identity system and Microsoft Entra changes.
  3. Check separate applications: Review accounting, dispatch, payroll, remote access, phone, website, and other business systems. Not every application uses the main business sign-in.
  4. Transfer work: Assign an owner for customer communication, calendars, shared files, projects, and recurring tasks.
  5. Preserve approved data: Decide what happens to the mailbox, OneDrive files, and other records before deleting an account or removing a license.
  6. Recover devices and access items: Track computers, phones, security keys, physical keys, badges, and company equipment.
  7. Review shared access: Rotate credentials the employee knew where required. Review delegated access, forwarding, recovery contacts, and shared administrative access.
  8. Reassign dependencies: Check automations, subscriptions, renewals, and recovery methods tied to the departing person.
  9. Close the loop: Verify the agreed actions, record exceptions, and assign a completion date for anything still pending.

Microsoft 365: keep access and preservation separate.

Microsoft’s former employee guidance separates blocking access from preserving mailbox and OneDrive information, handling mobile devices, transferring work, and eventually removing licenses or accounts. Choose the appropriate sequence for the organization’s retention needs and configuration.

Do not remove a license just to tidy up the billing before deciding how the data will be kept. Check current licensing and retention requirements for the intended mailbox and file arrangement. Give the successor only the access the business has authorized.

Session revocation also has limits. Microsoft explains that an application can maintain its own session, so disabling central access does not prove every application session has ended. Review the Microsoft Entra access revocation guidance and check important applications individually.

The handover should outlive the employee account.

A shared folder is not a successful handover if only the departing employee knows how it is organized. Have the receiving person confirm that they can find and use the information they need. Customer-facing addresses, recurring appointments, and business phone routing also need an owner.

Look for quiet dependencies: an invoice notification going to the old inbox, a scheduled report owned by the old account, or a renewal requiring a code sent to the employee’s phone. Document the replacement owner and test the necessary workflow.

This is also why routine Microsoft 365 administration and documented managed IT responsibilities matter before someone leaves. A current account inventory makes the departure easier to coordinate.

Lost or unreturned equipment needs a follow-up plan.

Record what is still outstanding and who will follow up. For enrolled devices, the available remote actions depend on management settings, device type, and connectivity. Do not assume a wipe command proves that all business information has disappeared from every location.

For personal devices, apply the agreed business-data policy and authorized management actions. Handle physical recovery through the business’s normal process. Keep the IT record focused on the access and equipment actions actually completed.

Finish with evidence: completion time, responsible person, transferred work, outstanding exceptions, and the next check. That is more useful than a ticket that only says “user removed.”

Common questions

Is changing the Microsoft 365 password enough?

No. Review sign-in blocking, active sessions, separate applications, device access, and shared credentials. Preserve and transfer authorized business data before deleting accounts. The required actions depend on the environment.

Can we keep the former employee’s email address working?

There may be options such as approved forwarding or a shared mailbox. Choose the arrangement based on business needs, access permissions, retention, and current licensing requirements. Document who is responsible for incoming messages.

Make staff changes a documented process.

Start with a free business conversation and initial onsite technology assessment with network discovery.

Request My Free Assessment

Call (269) 261-0269