Microsoft 365 Employee Offboarding: Access and Data Checklist
A Microsoft 365 employee offboarding checklist gives business owners and IT managers a consistent way to secure a departing employee’s account, review their data, and reassign the license they held. Handled inconsistently, offboarding can leave access open longer than intended, data unreviewed, or a license paid for after someone has already left. This guide outlines a planning sequence business owners and HR leaders can use alongside their IT provider, based on Microsoft’s published guidance for removing a former employee, reviewed October 12, 2026.
Approve the owner and timing
Before any account action begins, the authorized business or HR owner should confirm who holds decision authority over the departure and when access changes take effect. For an involuntary exit, that owner, not a generic IT checklist, sets the timing of the departure conversation and the account actions around it, based on the organization’s own HR and legal guidance. IT then executes the agreed actions once authorized, whether that means acting right away or holding changes until a specific time.
Documenting this approval in advance avoids confusion about who can request a sign-in block, a password reset, or a license change, and keeps the process aligned with company policy rather than individual judgment.
Inventory accounts, devices, and data
A clear inventory makes the rest of the checklist possible. Before touching any console, confirm what the departing employee had access to: their Microsoft 365 account, assigned devices, shared mailboxes, Teams or SharePoint sites they owned, and any Power Automate flows or connected apps tied to their identity. Record who is taking over each item.
This step also identifies systems outside Microsoft 365, such as line-of-business applications, where access needs separate review. Microsoft 365 support from MSP Pro Tech recommends agreeing a documented inventory of users, computers, applications, and the person responsible for each with your provider before offboarding begins, so nothing is missed once the sequence starts.
Revoke and verify access
Microsoft’s guidance on removing a former employee outlines several controls an administrator may need to use together: blocking sign-in, resetting the password, signing the user out of active sessions, and adjusting email access. No single action is a guaranteed instant cutoff. Blocking sign-in, for example, is meant to stop new authentication attempts, but it can take time to take effect across existing sessions and connected applications, and it does not by itself end sessions already in progress; the administrator should verify that sign-in has actually been blocked rather than assume it took effect right away. Microsoft’s step-by-step guidance covers how to combine these controls.
Effects can vary by token lifetime, connected application, and environment, so the administrator should verify in each case that access has actually been removed rather than assume one setting achieves it. For eligible managed clients, MSP Pro Tech’s support agreement includes a 15-minute remote support response time for urgent requests like this; that figure describes how quickly a technician responds, not a guarantee that blocking is initiated or completed within that window.
Preserve approved mailbox, OneDrive, and SharePoint work
Once access is controlled, review what mailbox and file content needs preserving for business continuity, and confirm that decision with the approved owner before acting. Converting a mailbox to a shared mailbox can let other employees reach past email without assigning them a new license, but depending on mailbox size, enabled features, and the organization’s own policies, a shared mailbox may still require a license. Confirm this against current Microsoft licensing terms rather than assuming it is always free.
Deleting the user’s account can break a shared mailbox or forwarding arrangement that depends on it, so sequence these actions carefully. Granting another employee access to the former employee’s OneDrive files is a useful short-term step, but it is not a permanent-retention guarantee; those files can still be affected by the organization’s retention policies, permission changes, or account lifecycle rules. Before removing licenses or deleting the account, check applicable retention policies, legal holds, and licensing requirements, and confirm that any content the business wants to keep has an approved preservation method. Microsoft’s related guidance addresses several of these mailbox and license follow-up steps. Retention settings and mailbox sync are not the same as a separate, agreed backup and recovery plan; organizations that want a recoverable copy outside Microsoft 365’s native retention should confirm that arrangement exists separately.
Review shared access, app and automation ownership, and business devices
Review the departing employee’s external sharing links, app registrations, and any automations they owned, then reassign or remove the ones tied to active business processes. This is a deliberate review, not a blanket revocation of every sharing link across the tenant; removing links still in active use elsewhere can disrupt other employees’ work.
Device actions should follow the organization’s existing device policy. A company-owned device should be collected and reviewed or reset according to that policy. A personal device enrolled under a BYOD arrangement should only have company access and company data removed as agreed in that policy, not be wiped in full. Confirm which category each device falls into before taking action.
Review licenses only after preservation
Only after confirming that mailbox, OneDrive, and SharePoint content has been handled, and that any required retention or legal hold has been checked, should the organization remove the departing employee’s license. Reclaiming a license before preservation steps are confirmed risks losing access to content that depends on it.
Review Microsoft 365 and Google Workspace licensing needs for a replacement hire before assigning the freed license, so the business avoids paying for a plan that doesn’t match actual usage. MSP Pro Tech’s managed IT services support this kind of recurring review as part of ongoing Microsoft 365 administration.
Document completion and exceptions
Record what was completed, by whom, and when: the access blocked, the data preserved, the devices reviewed, and the license outcome. Note any exceptions, such as a sharing link intentionally left active for a transition period, and who approved that exception. This record is the evidence a business owner or HR lead can point to if access or data handling is later questioned.
A documented, repeatable process, reviewed periodically with whoever manages the company’s Microsoft 365 environment, reduces the chance that a step gets missed because it depended on one person’s memory.
Offboarding checklist summary
- Timing and scope approved
Owner: Business/HR owner
Evidence: Written approval or ticket note - Accounts, devices, apps, and data inventoried
Owner: IT administrator
Evidence: Inventory record - Sign-in blocked, password reset, sessions revoked, email access reviewed
Owner: IT administrator
Evidence: Admin center confirmation - Mailbox and OneDrive preservation decision confirmed
Owner: Business/HR owner and IT
Evidence: Preservation record, licensing check - Shared links, app ownership, and automations reviewed
Owner: IT administrator
Evidence: Access review log - Device reviewed per company or BYOD policy
Owner: IT administrator
Evidence: Device checklist - License reviewed and reassigned after preservation
Owner: IT administrator
Evidence: License change record - Completion and exceptions documented
Owner: IT administrator
Evidence: Signed-off offboarding record
FAQ
Does blocking sign-in immediately stop all access?
Not on its own. Blocking sign-in is meant to stop new authentication attempts, but it can take time to take effect, and existing sessions, connected apps, and cached credentials may still need a password reset and session revocation to fully remove access. The administrator should verify the result rather than assume sign-in was blocked immediately.
Does a shared mailbox always avoid an extra license?
Not always. A converted shared mailbox commonly doesn’t require its own license, but size limits, enabled features, and the organization’s Microsoft 365 plan can mean a license is still needed. Check current licensing requirements for the specific mailbox before relying on it being license-free.
Is granting OneDrive access the same as backing up the data?
No. Granting another employee access to a former employee’s OneDrive preserves a path to the files for now, but whether that access actually remains available depends on the account’s lifecycle, the permissions granted, and whatever retention or preservation arrangements the organization has in place. If the account is later deleted, Microsoft’s retention period for the deleted user may allow temporary access to OneDrive content for a limited window, but that is not a substitute for a separate, agreed backup and recovery plan if the business wants a reliable, recoverable copy over time.
Plan your employee offboarding process
MSP Pro Tech, based in Stafford, TX, supports Microsoft 365 employee offboarding for businesses across the Greater Houston area with on-site visits coordinated within the agreed scope of work, and remote support nationwide where feasible. Plan your employee offboarding process with MSP Pro Tech, or call (713) 325-0836 to review your organization’s access and data checklist before your next departure.