What is the right way to offboard a user in Microsoft 365?

Key facts

• Blocking sign-in alone does not end existing sessions; revoke sessions as well.
• Preserve data before removing licenses, because license removal starts deletion timers.
• A deleted user can be restored for 30 days; after that the account is gone.
• Converting a mailbox to shared keeps mail accessible without a license if it is under 50 GB and has no hold.
• OneDrive files are retained for a set period after account deletion and can be given to a manager.

Step 1: Cut access immediately

For a planned departure, schedule these steps for the end of the last working day. For a termination, do them before or during the conversation with the employee.

• Block sign-in on the account in the Microsoft 365 admin center or Entra admin center.
• Revoke all sessions so refresh tokens are invalidated. In Entra ID this is the Revoke sessions action, or Revoke-MgUserSignInSession in Microsoft Graph PowerShell.
• Reset the password so cached credentials stop working.
• Remove registered MFA methods and passkeys so they cannot be reused.
• Remove admin roles, PIM eligibility and membership in privileged groups.
• If the account syncs from on-premises Active Directory, disable it there too, or the next sync may undo cloud changes.

Step 2: Secure devices and apps

For company-owned Windows devices enrolled in Intune, issue a wipe or retire action once the device is returned, or wipe remotely if it is not. Autopilot-registered devices can then be reset and redeployed to the next user.

For personal phones protected with Intune app protection policies, use a selective wipe to remove company data from Outlook, Teams and OneDrive without touching personal data.

Also review access outside Microsoft 365: SaaS apps connected through Entra ID single sign-on lose access when sign-in is blocked, but apps with local accounts, shared passwords or API keys the person held need separate action. Rotate shared credentials the person knew.

Step 3: Preserve mail and files

Decide what the business needs from the mailbox and OneDrive before you remove any license. Removing a license starts a grace period, after which data can be lost.

Step 4: Transfer ownership

• Assign new owners to Microsoft 365 groups and Teams where the user was the only owner.
• Reassign SharePoint site ownership and check site collection admins.
• Find Power Automate flows and Power Apps the user owned and assign co-owners before the account is removed.
• Move Planner plans, Forms and shared calendar ownership.
• Check app registrations and enterprise apps listing the user as owner.
• Update distribution lists, shared mailbox delegates and approval workflows that route to the person.

Step 5: Remove licenses and delete

Once mail, files and ownership are handled, remove licenses so they can be reused. If you converted the mailbox to shared, confirm the conversion completed before removing the Exchange license.

Delete the account when your retention timeline allows. Deleted users stay in the Entra ID recycle bin for 30 days and can be restored with their data. After that, the account and any unprotected data are permanently removed. OneDrive content follows the OneDrive retention setting, which can be adjusted in the SharePoint admin center.

Record the offboarding in a ticket or log: who approved it, when each step ran and where data went. Auditors and future investigations depend on it.

Automating the checklist

Manual offboarding is where steps get missed. Entra ID Lifecycle Workflows, where licensed, can trigger leaver tasks from an HR attribute such as the employee leave date. Many organizations also script the steps with Microsoft Graph PowerShell or build a Power Automate flow started from an HR request. Whatever you use, keep a human approval step for terminations and a checklist that covers apps outside Microsoft 365.

How Accred Consulting approaches it

Accred Consulting builds offboarding as a documented, repeatable process rather than a one-time cleanup. Discovery maps where identities live, including Entra ID, on-premises Active Directory and SaaS apps, plus your retention and legal hold requirements. Accred then writes the runbook, sets up scripts or Lifecycle Workflows where licensed, and ties license reclamation to the process. At handover you get documentation and knowledge transfer for your team. You work directly with the US-based specialists assigned to the engagement, and an optional Support retainer can run offboarding for you.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions