Employee Offboarding Checklist for Microsoft 365

Onboarding gets a lot of attention because a new starter needs to be productive fast. Offboarding is just as important but gets rushed far more often - and a rushed offboarding is how ex-employees end up with lingering access to email, files, and business systems weeks or months after they've left. Here's a practical Microsoft 365 offboarding checklist.

Know someone who needs this checklist?

Forward it to whoever handles IT, admin, or operations on your team.

✉️ Forward to Your Team

Before their last day

Confirm exactly what the departing employee has access to - Microsoft 365, shared mailboxes, Teams, SharePoint sites, and any connected third-party apps
Identify any files or email that need to be reassigned to a manager or colleague before their access is removed
Plan for auto-reply and email forwarding, if the business wants incoming email redirected to someone else
Check for any personal use of the account (calendar entries, personal files in OneDrive) that should be handled sensitively

On their last day

Reset the account password immediately, and revoke all active sign-in sessions across every device
Remove or block the account from signing in (don't delete it immediately - see below)
Revoke MFA methods and remove the Authenticator app registration
Remove the employee from all Teams, distribution lists, and shared mailboxes
Set up an auto-reply on their mailbox if required, directing senders to a current contact
Convert their mailbox to a shared mailbox if ongoing access to their email is needed (this avoids paying for an unused licence while retaining the data)
Collect and wipe any company-owned devices - laptop, phone, security keys
Revoke access to any third-party apps connected via "Sign in with Microsoft"
Remove building access, VPN access, and any other systems not directly tied to Microsoft 365

After their last day

Reassign their OneDrive files to a manager or relevant team member
Transfer ownership of any SharePoint sites, Teams, or shared documents they owned
Review whether their mailbox needs to be retained for compliance or legal reasons, and for how long
Once retention requirements are met, remove the licence and archive or delete the account per your data retention policy
Update any documentation, org charts, or system access lists that referenced them

Why this matters more than it seems

An ex-employee with lingering access isn't usually a deliberate security threat - it's an unnecessary risk that costs nothing to remove and everything to ignore. Unused accounts are also a common target in credential-stuffing attacks, since nobody notices if they're compromised. If your business doesn't have a formal offboarding process, this checklist is a reasonable starting point - see our New Employee IT Onboarding guide for the equivalent process at the other end of employment.

Building this into a repeatable process

The businesses that get this right treat offboarding as a standard HR-to-IT handoff, not something IT finds out about after the fact. A simple shared checklist, triggered the moment a resignation or termination is confirmed, closes most of the gap - it doesn't need to be complicated, it just needs to happen every time.

Frequently Asked Questions

Should we delete a departing employee's account straight away?

Generally not immediately. It's better to disable sign-in, reset the password, and revoke active sessions on their last day, then hold off on deleting the account until you've confirmed their files and mailbox have been reassigned and any retention requirements are met. Deleting too early can mean losing access to data you still needed.

What happens to a departing employee's emails and files?

Their OneDrive files and any SharePoint or Teams content they owned should be reassigned to a manager or colleague before the account is removed. If ongoing access to their mailbox is needed, converting it to a shared mailbox keeps the data available without paying for an unused licence.

Do we need to keep a former employee's mailbox for compliance reasons?

It depends on your industry and the type of data involved, so it's worth checking with your compliance adviser or industry body on how long records need to be retained in your specific situation. As a general rule, it's safer to confirm retention requirements before archiving or deleting anything rather than assuming it's fine to remove straight away.

What's the biggest offboarding mistake Perth businesses make?

Treating it as an afterthought that IT finds out about after someone has already left, rather than a standard handoff triggered the moment a resignation or termination is confirmed. A simple shared checklist that runs every time closes most of the gap, without needing to be complicated.

Want a documented onboarding and offboarding process?

We build and manage standardised onboarding and offboarding workflows for Perth businesses, so access changes happen consistently every time - not just when someone remembers.

Get a Free Consultation