A staff offboarding IT checklist has three stages. Before the last day, list every account, device and shared password the person uses. On the day, reset their password, sign them out everywhere, block sign-in, remove their MFA methods and collect their devices. Afterwards, reclaim the licence and check the audit logs. Key IT's version below builds on Microsoft's documented steps.
Skip a step and a former employee's login, or a phished copy of it, can keep working long after they have gone. The OAIC asks, in its guide to securing personal information, how quickly accounts are removed or suspended once someone leaves. This checklist covers the IT side only, for businesses on Microsoft 365.
Who does what, and when?
Gaps appear when each task belongs to someone different, so agree owners before anyone resigns.
| Task | When | Owner |
|---|---|---|
| Set the access cut-off time and tell IT | Before, once the exit is confirmed | Manager or HR |
| List accounts, apps, devices and shared passwords | Before | Manager, with IT |
| Move working files and hand over admin roles | Before | Leaver and manager |
| Reset password, end sessions, block sign-in | On the day, at the cut-off | IT |
| Remove MFA methods; convert or forward the mailbox | On the day | IT; the manager picks who gets the mail |
| Remove from groups, roles and non-Microsoft apps | On the day | IT and each app's owner |
| Change shared passwords, Wi-Fi keys and door codes | On the day | Office manager or IT |
| Recover devices, then wipe or retire them | On the day | Manager collects; IT wipes |
| Reclaim the licence, review logs, delete the account | In the following weeks | IT |
What should you do before an employee's last day?
Set the cut-off
For a resignation, access usually ends with the final shift. For a dismissal, it should end while the meeting is under way.
List what they can reach
Beyond Microsoft 365: accounting software, CRM, practice management, banking and supplier portals, social media and the domain registrar. Disabling the Microsoft account won't touch an app with its own login.
Hand over ownership
If they are a Microsoft 365 admin or the sole owner of a Team, SharePoint site or registrar account, transfer that first.
Move files; consider a hold
Shift working documents from OneDrive to a shared SharePoint or Teams site. If a dispute is possible, Microsoft's overview for removing a former employee points to Purview eDiscovery legal holds for preserving their data.
What should IT do on the employee's last day?
Order matters, because some controls apply more slowly than others.
Reset the password
Microsoft's guidance on preventing a former employee's sign-in names this as the first step. If accounts sync from an on-premises Active Directory server, make the change there.
End open sessions
On the user's Account tab in the admin centre, choose Sign out of all sessions. An access token stays valid for an hour, Microsoft explains, so an open browser tab may keep working until it lapses.
Block sign-in
Microsoft cautions that blocking may need as long as 24 hours to take hold, which is why the reset comes first. Its guide to revoking user access gives the Entra route: clear Account enabled, then Revoke sessions.
Strip MFA methods and app passwords
In the Entra admin centre, Require re-register MFA deletes their phone numbers, Authenticator app and software OATH tokens and deactivates hardware tokens. Delete their app passwords too. Passkeys aren't on Microsoft's list, so check the user's Authentication methods page for anything left.
Close mailbox access
In the Exchange admin centre, turn off Outlook desktop, Outlook on the web, mobile, IMAP, POP3 and Exchange web services.
Remove memberships and roles
Security groups, distribution lists, Teams, shared mailbox permissions and admin roles.
Remove them from every other app
Entra ID can't directly revoke a session token that an app issued itself, Microsoft says, so each system needs its own removal. If they acted for the business in government online services such as tax through the Relationship Authorisation Manager (RAM), its guidance on removing authorisations says to remove them immediately once no longer valid; a principal authority or authorisation administrator can do it.
Change shared secrets
Wi-Fi keys, alarm and door codes, shared logins and any password vault they could open.
Should you convert the mailbox to shared or forward it?
Both keep the address alive for clients.
| Option | What the team gets | Licence | Watch out for |
|---|---|---|---|
| Convert to a shared mailbox | All old email and calendar, plus new mail, in one mailbox several people open | None needed while under 50 GB | Convert before removing the licence, and reset the password; a litigation hold on it still needs a licence |
| Forward to a colleague | New email only | The mailbox must survive, so keep it licensed or convert it first | Old mail stays behind; set a date to review it |
| Export old mail, then delete the account | A copy of past email in someone else's Outlook | Freed once the account goes | The address stops receiving mail |
Microsoft's notes on converting a user mailbox to shared flag two traps: skip the password reset and the old username and password still open it, and inbox rules carry over, so check for any rule forwarding to a personal address. Either way, keep the account while it anchors the mailbox or forwarding, and cancel meetings they organised so booked rooms free up.
What happens to their OneDrive files?
Move what matters before you touch the licence. When an account is deleted, Microsoft's OneDrive retention rules keep the files for 30 days by default and hand the person's manager access, provided access delegation is on and a manager is recorded in Entra ID. With no manager or secondary owner set, nobody gets automatic access. Removing only the licence is no safer: unlicensed OneDrive accounts turn read-only after 60 days and are archived after 93, after which nobody can open them without relicensing or paid reactivation.
How do you wipe or retire a leaver's devices?
Company laptops and phones in Intune
Wipe factory resets the device, removing all data, apps and settings. If it is leaving the business, remove it from Autopilot and Entra ID as well.
Retire for personal phones
Retire takes off company apps, managed settings and email profiles but keeps personal data, and runs at the device's next check-in. If you retire an Entra-joined Windows PC rather than wiping it, back up its BitLocker recovery key first.
Get the hardware back regardless
A remote wipe needs the device online; an offline laptop keeps its local data.
Device management depends on your licence; see our comparison of the Microsoft 365 business plans.
What should you check in the weeks after someone leaves?
Reclaim the licence once the mailbox is converted and the files have moved. Removing a licence from an ordinary mailbox keeps email, contacts and calendar for 30 days, then Microsoft deletes them for good.
Read the logs before they expire
The Purview audit log holds 180 days of records for users on non-E5 licences, while Entra sign-in logs last seven days on Entra ID Free and 30 days with P1 or P2. Look for bulk downloads, files shared to personal addresses, new forwarding rules and any sign-in attempt after the cut-off.
Treat odd activity as an incident
A sign-in after the cut-off calls for our hacked Microsoft 365 account checklist.
Delete the account once nothing depends on it, and update your asset register.
How is offboarding different for contractors and offshore staff?
Same steps, different devices and paperwork. The OAIC's guide counts contractors among the insiders to guard against.
Their device isn't yours
You can't wipe a contractor's own laptop, though Microsoft notes you can wipe corporate data from managed apps on an unmanaged device. A virtual desktop can keep company files in the cloud rather than on their laptop in the first place.
Set an end date on day one
Record the contract end date against the account and diarise the removal, so access doesn't outlive the work.
Get it in writing
Ask the contractor or staffing provider to confirm your data has been returned or deleted.
Overseas teams bring extra Privacy Act duties, covered in our guide to offshore staffing data security. Accounting firms, see IT for accountants.
How can Key IT help with staff offboarding?
Managed clients raise a departure like any other request, by phone, email or the portal, and the Key IT help desk records every ticket. Desk hours are 8am to 5pm on weekdays; after hours, a rostered on-call engineer covers urgent problems for managed clients, so plan a sensitive exit with the desk ahead of time. Engineers are all security-certified, and if anything suggests an active attack, the desk escalates it to Key IT's 24/7 SOC monitoring.
Unsure whether past leavers were cleaned up? Key IT's Melbourne IT audit checks whether former staff can still sign in, flags licences left on leavers and looks for mail forwarded outside the business.
Frequently asked questions
How quickly should a former employee's access be removed?
When their employment ends, timed to the exit rather than the next morning. The OAIC's security guide asks exactly this. In Microsoft 365, reset the password and end sessions first, because Microsoft says a sign-in block can need up to 24 hours to apply. Brief your IT provider before the last day.
Should we delete a departed employee's Microsoft 365 account straight away?
Usually not. If you convert their mailbox to shared or forward their email, Microsoft says the account must stay to anchor it. Deleting it also starts a 30-day clock on their OneDrive and mailbox, so block sign-in now and delete only once nothing depends on the account.
Can we keep a former employee's email address working?
Yes. Convert the mailbox to a shared mailbox so colleagues see old and new mail, or forward new mail to whoever takes over. A shared mailbox needs no licence while it stays under 50 GB. Reset the password when you convert it, because Microsoft notes the original username and password otherwise keep working.
What happens to a leaver's OneDrive files?
If you delete the account, Microsoft keeps the OneDrive for 30 days by default and gives the person's manager access, provided a manager is set and access delegation is on. Removing only the licence is no safer, because unlicensed OneDrive accounts go read-only after 60 days and are archived after 93. Move working files to SharePoint or Teams first.
Do we need to wipe a former employee's laptop?
For a company laptop, yes. Intune's wipe action resets it to factory settings remotely, but only once the device is online, so recover the laptop as well. For a personal phone, Intune's retire action removes company apps, email profiles and managed settings and leaves personal data alone.
Can Key IT check whether former staff still have access?
Yes. Key IT's IT audit, delivered as the free IT & Cyber Security Review, checks whether former staff can still sign in, which licences sit on leavers and whether mail is forwarded outside the business. Security-certified engineers check live settings, and the findings are yours to act on.
Are your staff's logins already exposed? A free dark web scan checks your business email domain against known breaches.
Request the Free Scan