Employee Offboarding Security Checklist for Microsoft 365
Updated: 18 hours ago
It's someone's last day, or it's a sudden exit. Their laptop at home is still signed in to Outlook and Teams. Their personal phone still gets company email. A forwarding rule they set up two years ago is still sending copies of client messages somewhere.
An employee offboarding checklist fixes that, and the order matters: stop access first, preserve data second, reclaim licenses last. Microsoft 365 won't do it for you.
24uNet provides cybersecurity-first managed IT from Denver, Colorado, and College Station, Texas. Below is a day-one checklist for Microsoft 365, what managers should tell IT the same day, and talking points for advisers facing an SEC exam.
THE SHORT VERSION
On the day someone leaves, block Microsoft 365 sign-in, reset the password, and sign the account out of all sessions so existing tokens stop renewing. Then recover mailbox and OneDrive data, remove admin roles and licenses, wipe company devices, and document every step. Leaving only the account "disabled" without revoking sessions is a common gap.
Why offboarding fails (and why order matters)
Microsoft's own process for removing a former employee runs in a deliberate order: prevent sign-in, save the mailbox, wipe and block mobile devices, forward email or convert to a shared mailbox, give someone else access to OneDrive and Outlook data, remove the license, and only then delete the account. Do it out of order and you either leave a door open or lose data you needed.
Blocked is not the same as signed out. Blocking sign-in stops new sign-ins, but it doesn't instantly end sessions that are already open. Microsoft pairs it with resetting the password and choosing "Sign out of all sessions." Even then, Microsoft notes an access token is good for about an hour, so the person may stay signed in until that token runs out or they leave the page they're on.
Small firms have a few extra risks: shared passwords for common accounts, personal phones with company mail on them, an admin role nobody remembers granting, and inbox forwarding rules that keep running long after the person is gone.
Day-one Microsoft 365 offboarding checklist
Run this list the day someone leaves, or hand it to your IT provider:
Reset the password and block sign-in (Microsoft 365 admin center, Active users).
Sign out of all sessions. In Microsoft Entra, disabling the account and choosing "Revoke sessions" invalidates refresh tokens so the session stops renewing.
Remove them from groups, Teams and SharePoint sites, and from any Conditional Access exclusions or trusted locations that treated them as an exception.
Strip admin roles such as Global Administrator or Exchange Administrator before or as you disable access.
Review MFA and sign-in methods. Once the account is locked, remove methods you no longer need. If the exit was unexpected or hostile, look for methods nobody recognizes.
Handle the mailbox. Convert it to a shared mailbox or set forwarding to the successor. Check inbox rules for auto-forwarding, deleting or hiding mail, and remove anything suspicious.
Hand off OneDrive and SharePoint files. Give the manager or successor access and move what's needed before the account is deleted.
Reassign ownership of shared mailboxes, distribution lists and Teams so nothing gets stranded.
Review apps they authorized. Check enterprise applications and user consents for third-party apps that still have access to their data.
Wipe or unenroll company devices. Remove company data from managed phones and PCs, take them out of device management where it applies, and collect the hardware.
Reset shared or generic accounts the person knew, such as the scanner, the conference room, or info@.
Remove the Microsoft 365 license only after data is handed off and any holds are dealt with. Then reassign the seat.
Delete the account only when your retention policy allows. If accounts sync from an on-premises Active Directory, Microsoft says you must delete them there, not just in Microsoft 365.
Cut access to non-Microsoft systems the same day: CRM, payroll, document portals, custodian sites, VPN. Examiners ask about these too.
Two timing notes from Microsoft. When you remove a license, the person's email, contacts and calendar are kept for 30 days and then deleted permanently. After you delete the account, OneDrive and Outlook content is kept for 30 days, during which you can restore the account. Retention isn't the same as backup, which is why we cover whether Microsoft 365 backs up your data separately.
Hostile or no-notice exits
When an exit is contested or sudden, do the same list with a different emphasis. Revoke sessions first, wipe company devices, and review mailbox rules and forwarding right away. Bring in counsel if there's any question about preserving mail. Keep it calm and procedural.
Manager / HR ticket checklist (what to send IT the same day)
IT can only cut what it knows about. Put this in the ticket:
Legal name, email address, and the last day and time access should end
Successor for mail and files
Devices issued: laptop, phone, security keys or tokens
Any admin or privileged roles you know about
Shared mailboxes and Teams they owned
Non-Microsoft apps to cut off
Whether the mailbox must be preserved for a legal or HR hold
Whether the exit is friendly or contested (this changes urgency, not the checklist)
SEC exam talking points for RIAs
If you're a registered investment adviser, offboarding isn't just good hygiene. It's an exam topic. This matters most for financial services firms, and law firms holding client files have the same reasons to get it right.
SEC exam staff have flagged it before. A 2019 SEC risk alert on Regulation S-P listed departed employees among frequent weaknesses: former employees kept access rights after leaving and could reach restricted customer information.
It's coming up in current exams. A compliance firm reporting on Regulation S-P exams it observed in 2026 says SEC staff asked the adviser's technology provider how access is revoked when an employee leaves, and whether access to non-Microsoft systems is periodically reviewed.
Be ready to show: a written offboarding procedure, the ticket or record showing access was removed promptly, a list of systems that hold client information, and who owns each step, the firm or the IT provider.
This is process guidance, not legal advice. Talk to your CCO or counsel about how offboarding fits your Regulation S-P program.
After offboarding, watch for leftovers
Even a careful offboarding can miss something: a session on a forgotten device, an MFA method nobody removed, a rule forwarding mail to a personal address. Signs to watch for include sign-in attempts on a closed account, new sign-in methods, and unexpected forwarding.
That's the job of identity threat detection, after-sign-in monitoring that watches what Microsoft 365 accounts actually do. Offboarding itself is one of the identity lines in our Security Baseline, next to MFA on every account and conditional access, so it runs the same way every time instead of from memory.
Some firms engage us for specific services like these under a service authorization. Others put IT and security under one master service agreement from day one. Either way, the offboarding steps get written down.
Frequently asked questions
What is a Microsoft 365 employee offboarding checklist?
A same-day sequence to block sign-in, revoke sessions, recover mail and files, remove roles and licenses, wipe devices, and cut related app access so a former employee cannot reach company data.
Does blocking sign-in immediately kick someone out of Outlook and Teams?
Not by itself. Microsoft also has you reset the password and sign the user out of all sessions (revoke sessions). Existing access tokens can remain valid for about an hour.
When should we remove the Microsoft 365 license?
After you have preserved or transferred mailbox and OneDrive data you need, and after any legal/compliance holds are handled. Microsoft describes retention windows when licenses or accounts are removed.
Should we convert the mailbox to a shared mailbox?
Often yes, so customers can still email the old address and a successor can answer — then remove the user license according to Microsoft's shared-mailbox guidance and your retention policy.
What do SEC examiners care about with offboarding?
OCIE has flagged departed employees who kept access to customer information. Exam reporting also describes questions to IT providers about how access is revoked when someone leaves. Document the process and evidence.
What should managers include on the offboarding ticket?
Identity, cutoff time, successor, devices, admin roles, shared resources they owned, non-Microsoft apps, and whether mail must be preserved for a hold.
How does 24uNet help?
We help firms put offboarding into a repeatable identity process and watch accounts after sign-in. Call Denver (303) 468-5515 or College Station (979) 256-5100, or start at /security-baseline, /itdr, and /secure-your-network.
Talk to a real person at 24uNet
Need a repeatable Microsoft 365 offboarding process, or an exam-ready identity review? We can walk through how your firm handles leavers today, check your Microsoft 365 for leftover access, and show you in writing what we'd tighten first. Read our Security Baseline or see how identity threat detection works.
Prefer to talk? Call Denver (303) 468-5515 or College Station (979) 256-5100.
Related reading: The Importance of IT Assessments for Executives; Premium IT Support Services for Executives.
ABOUT THE AUTHOR
Dane Gray, CEH, CompTIA Security+ — Cofounder, 24uNet. Dane has 30+ years in IT and cybersecurity and is a Cyber AB Registered Practitioner. He leads independent security reviews, SEC exam prep for RIAs, and Microsoft 365 identity work for firms served from 24uNet's offices in Commerce City, CO 80022 and College Station, Texas. Connect with Dane on LinkedIn.
Last reviewed: October 7, 2026
General information, not legal advice.
Sources: Microsoft Learn, Remove a former employee: overview · Microsoft Learn, Step 1: Prevent user sign-in and block access · Microsoft Learn, Step 6: Remove the license · Microsoft Learn, Revoke user access in an emergency · SEC OCIE Risk Alert, Regulation S-P (April 16, 2019) · Key Bridge Compliance, "Regulation S-P Sweep Examination: What We Are Seeing First-Hand" (Sept. 29, 2026)
Comments