Employee Leaving? The IT Offboarding Checklist for Microsoft 365

By TechTrone Team — Published 2026-11-13

Quick answer: When an employee leaves, block their Microsoft 365 sign-in and sign them out everywhere on their last day, then save their email and files before you delete anything or remove the license. Change any shared passwords they knew, collect and wipe their devices, and remove them from every other app they used. Doing these steps in the right order protects your data and keeps your business running.

Most small offices have no written process for this. The result is ex-employees who can still read company email months later, lost files, and Microsoft 365 licenses that keep billing. Use this checklist the next time someone leaves your team, whether it is a friendly resignation or a sudden termination.

What This Checklist Covers

  • 1. Before the last day
  • 2. On the last day: lock down access
  • 3. Save their email and OneDrive files
  • 4. Devices and hardware
  • 5. Other apps, passwords, and accounts
  • 6. Does Microsoft keep a departed employee's data?
  • 7. Final cleanup
  • 8. Frequently asked questions

1. Before the Last Day

  • ☐ Confirm the exact date and time access should end with HR or the owner
  • ☐ List every system the person uses: Microsoft 365, accounting or practice software, CRM, phone system, banking portals, vendor portals, and social media accounts
  • ☐ Identify who will take over their email, files, clients, and responsibilities
  • ☐ Ask them to move shared work files from personal folders to SharePoint or Teams
  • ☐ Make sure business accounts they created use a company email address, not a personal one

For involuntary terminations: Coordinate with IT so access is cut off during the termination meeting, not after it.

2. On the Last Day: Lock Down Microsoft 365 Access

Do these steps in the Microsoft 365 admin center or Microsoft Entra admin center, in this order:

  1. Block sign-in. This stops new logins immediately without deleting anything.
  2. Reset the password. This prevents use of any saved password.
  3. Revoke sessions (sign out everywhere). Blocking sign-in alone does not instantly log out a phone or laptop that is already signed in. Revoking sessions forces every device to sign in again, which then fails.
  4. Remove their MFA methods and registered devices so their phone can no longer approve sign-ins.
  5. Remove them from admin roles, shared mailboxes, and security groups.
  6. Disable mobile email access and remotely wipe company data from their phone if it was used for work.

Administrator blocking a departed employee's Microsoft 365 sign-in

3. Save Their Email and OneDrive Files

This is where most businesses lose data. Do not delete the user or remove the license until these steps are done.

Email

  • ☐ Set an automatic reply telling senders who to contact instead
  • ☐ Convert the mailbox to a shared mailbox and give the manager or replacement access. Shared mailboxes under 50 GB generally do not need a paid license, so you can stop paying for the seat and still keep the email
  • ☐ Optionally forward new mail to the person taking over
  • ☐ If the employee could be involved in a dispute or legal matter, ask your IT provider about placing the mailbox on hold before making changes

OneDrive and Teams

  • ☐ Give the manager access to the user's OneDrive
  • ☐ Move important files into SharePoint or a team site where the business owns them
  • ☐ Transfer ownership of any Teams, Microsoft 365 groups, or shared calendars they owned
  • ☐ Check for files they shared with outside people and remove those links if needed

4. Devices and Hardware

  • ☐ Collect the laptop, desktop, phone, tablet, security keys, and building access cards
  • ☐ Back up anything needed from the device before wiping it
  • ☐ Wipe and reset company devices before reassigning them. If you use Microsoft Intune, retire or wipe the device from the admin center
  • ☐ Remove the device from monitoring and endpoint protection licensing only after it has been wiped
  • ☐ Update your hardware inventory

5. Other Apps, Passwords, and Accounts

Microsoft 365 is only part of the picture. Former employees often keep access through other systems.

  • ☐ Shared passwords. Change any password they knew: Wi-Fi, alarm codes, shared logins, vendor portals, and social media. A business password manager makes this much easier
  • ☐ Line-of-business software. Disable their account in your accounting, practice management, or CRM software
  • ☐ Remote access and VPN. Remove VPN accounts and remote desktop permissions
  • ☐ Phone system. Reassign their extension and voicemail. See our VoIP guide
  • ☐ Banking and payments. Remove them as an authorized user on bank, payroll, and payment accounts
  • ☐ Domain and website. Make sure they are not the only admin on your domain registrar, website, or Google Business Profile
  • ☐ Apps they signed up for themselves. Review company card statements for subscriptions in their name. Our guide to software license management explains how to track these

Office manager and IT reviewing access to remove after an employee leaves

6. Does Microsoft Keep a Departed Employee's Data?

Only for a limited time, and not the way most people assume. Microsoft runs a highly reliable service, but it is not a full backup of your business data.

  • Deleted users can usually be restored for about 30 days. After that, the account and its mailbox are permanently gone.
  • A deleted user's OneDrive is kept for a retention period (30 days by default unless your admin changed it), then deleted.
  • Deleted emails and files sit in recycle bins for limited periods before they are purged.

If someone deletes the account too early, or a departing employee deletes files on their way out, you may not be able to get them back. That is why converting the mailbox, moving files to SharePoint, and having a separate Microsoft 365 backup matter. Learn more in why data backup is important for your business.

7. Final Cleanup (30 Days Later)

  • ☐ Confirm the manager has everything they need from the mailbox and OneDrive
  • ☐ Remove the Microsoft 365 license so you stop paying for it
  • ☐ Delete the user account if it is no longer needed
  • ☐ Review sign-in logs for any attempts to use the old account
  • ☐ Record the offboarding date and steps completed. This documentation helps with HIPAA, the FTC Safeguards Rule, and cyber insurance questionnaires

Frequently Asked Questions

What is the first thing to do when an employee leaves?

Block their Microsoft 365 sign-in and revoke their active sessions. Then save their email and files before removing the license or deleting the account.

Should I delete a former employee's Microsoft 365 account?

Not right away. Convert the mailbox to a shared mailbox and move their files first. Deleting too early can permanently erase data after the restore window closes.

How do I keep a former employee's email without paying for a license?

Convert the mailbox to a shared mailbox. Shared mailboxes under 50 GB generally do not require a license, and you can give the manager access.

Can a former employee still access email on their phone?

Yes, if you only change the password. Revoke sessions and remove the device so the phone is forced to sign in again.

Does Microsoft back up my Microsoft 365 data?

Microsoft keeps deleted items for limited retention periods, but it does not provide long-term, point-in-time backup of your data. Most businesses add a dedicated Microsoft 365 backup.

Let TechTrone Handle Offboarding for You

With TechTrone's managed IT services, you send one email when someone leaves and we take care of the rest: access removal, mailbox and file transfer, device wipes, and license cleanup, all documented. We also provide Microsoft 365 management and backup for businesses across Long Island and New York City. Contact us to get started.

More IT Blog Articles