Offboarding in M365: what to do when an employee leaves

An employee leaving is a routine administrative matter, until it is done in a rush at the last hour of their final day and someone forgets a step that then surfaces a month later as a security incident. The risk is not theoretical: a former employee with active access to company email or shared files is a security hole, which the company may not discover for a long time because everything appears normal on the outside. M365 offboarding involves a few steps that are best documented once and then simply repeated, rather than reinventing them each time under pressure.

Access first, everything else follows.

The first step on the day of departure (or earlier in the case of a contentious separation) is to block account access and log out all active sessions; otherwise, login will remain valid on phones or laptops even after the password has been changed. Only then does it make sense to address what happens next with data and access rights. Reversing this order - dealing with data handover first and blocking access "when there's time" - is the most common way offboarding goes wrong.

Mailbox: transfer, not deletion

Deleting the mailbox on day one is tempting but often premature, business correspondence may still be needed for weeks or months. A more practical approach is to convert the mailbox into a shared mailbox (without a license, see F-gas certification audit), to which a supervisor or successor gains access. An alias for another colleague or an automatic reply with the successor's contact details keeps communication with clients smooth without requiring the former employee to have active access.

OneDrive: who receives the content

Files in the former employee's OneDrive are not automatically deleted: the administrator must explicitly set who gets access, usually the direct supervisor. Without this step, the content will disappear along with the account once the retention period expires. For key roles, it is advisable to include a "check OneDrive and shared files" step in the process, rather than relying on someone doing it incidentally.

Licence: release only after handover

Releasing the licence on day one may seem budget-friendly, but without first migrating the mailbox and OneDrive, it means losing access to data you still need. The correct sequence is: block sign-in, migrate and hand over the data, and only then release the licence: typically after a few days, not minutes.

Groups, Teams and MFA devices

The account must be removed from all distribution lists and groups in Teams and SharePoint; otherwise, the former employee will remain part of communications they should no longer access. It is also advisable to deregister any enrolled MFA devices and remove the corporate profile from personal phones (via Intune) at this opportunity - otherwise, a backdoor into the system remains open even after the password is blocked. For roles with access to sensitive data, it is best to verify these steps manually rather than relying solely on removal from a single main group.

Standard departure versus risky departure

Not every departure is the same. For a standard resignation with notice, most steps can be scheduled for the last working day, and the mailbox and OneDrive can be handed over calmly. In a contentious separation - immediate termination of employment, dispute, or suspicion of access misuse - the correct order is reversed: block access as soon as possible, ideally before the employee learns of the decision, and only then address data handover. For administrator or other privileged accounts, this applies even more strictly - the window between the decision and blocking access is the most critical risk period.

Offboarding checklist in brief

• Block login and log out all active sessions.
• Convert a mailbox to a shared mailbox, set up an alias or an automatic reply.
• Transfer access to OneDrive to a supervisor or successor.
• Remove from all groups, Teams and distribution lists.
• Disable MFA devices and corporate profiles on personal phones.
• Release the licence only after data handover.

A checklist worked through point by point is more reliable than "we'll manage somehow", because under pressure steps are easily skipped. Companies that have offboarding sorted usually also have everything else in order. MFA and conditional access Generally, both are the same discipline, just applied at a different stage.