Most businesses think offboarding means resetting a password and removing a license. That leaves the door open in half a dozen places: active sessions on phones, mail forwarding rules, app consents, personal devices still syncing files. This Microsoft 365 offboarding checklist walks through the steps in the order that actually cuts access, then preserves the data the business needs to keep.
Why the usual approach leaves gaps
A password reset does not end existing sessions. A phone that already holds a refresh token for Outlook can keep syncing mail for a while after the password changes. A laptop that was never enrolled in Intune keeps every OneDrive file it already downloaded. An inbox rule that forwards mail to a personal Gmail account keeps working until someone deletes it.
In the tenants I review, the most common offboarding gaps are:
Sessions not revoked, so mobile apps stay signed in
External forwarding rules left in place
The user still listed as owner of Teams, groups or SharePoint sites
Admin roles still assigned to a disabled account
Personal devices with company data and no way to remove it
Third-party apps the user authorized with their Microsoft account
None of these are exotic. They are just steps nobody wrote down.
Step 1: Cut access first (the first 15 minutes)
Do these steps at the moment the person is told, or immediately before for a sensitive departure. Order matters: stop new sign-ins, then kill existing ones.
Block sign-in. In the Microsoft 365 admin center, go to Users > Active users, select the user and choose Block sign-in. In a hybrid environment, disable the account in Active Directory as well, or the next sync can undo cloud changes.
Reset the password. Use a long random value and do not share it.
Revoke sessions. In the Microsoft Entra admin center, open the user and select Revoke sessions. This invalidates refresh tokens so apps on phones and laptops must sign in again, which now fails.
Remove authentication methods. Delete registered phone numbers, Microsoft Authenticator registrations and passkeys so nobody can use them to recover the account.
Remove admin roles. Check Roles & admins in Entra and any Privileged Identity Management eligible assignments, which are easy to miss.
Step 2: Close the side doors
Attackers and unhappy employees both use the same quiet channels. Check each one.
Mail forwarding and inbox rules. In the Exchange admin center, check mailbox forwarding on the user, then review inbox rules for anything that forwards, redirects or deletes. An outbound spam policy that blocks automatic external forwarding tenant-wide is the better long-term fix.
Mailbox delegation. Remove the user’s Full Access and Send As rights on other mailboxes, especially shared finance or HR mailboxes.
Enterprise app consents. In Entra, review the user’s applications and remove consents to third-party apps that can read mail or files on their behalf.
External sharing links. Check OneDrive for “Anyone” links the user created. Those links work regardless of the account’s status.
Group ownership. Reassign ownership of Teams, Microsoft 365 groups and SharePoint sites so they do not become ownerless.
Step 3: Deal with devices
What you can do here depends entirely on whether devices were managed. This is where an Intune rollout pays for itself.
Device type
Action in Intune
Result
Company-owned Windows or Mac
Wipe (or Autopilot Reset for reuse)
Device returned to a clean state, ready for the next person
Company-owned iPhone or Android
Wipe
Full reset, removes all data
Personal phone with app protection policies
Selective wipe of app data
Removes Outlook, Teams and OneDrive company data only, personal photos untouched
Personal device enrolled as BYOD
Retire
Removes company profiles, apps and data
Unmanaged device
None available
Data already downloaded stays. Rely on revoked sessions and Conditional Access
If that last row describes most of your fleet, offboarding will always be incomplete. Our BYOD for Microsoft 365 approach uses app protection policies so you can remove company data from personal phones without touching anything personal, and Intune deployment brings company devices under management.
Step 4: Preserve the data the business needs
Once access is closed, protect what the person leaves behind.
Mailbox
Convert the user mailbox to a shared mailbox so a manager or successor can read it. The mailbox must still have a license when you convert it. After conversion, you can remove the license as long as the mailbox is under 50 GB. Do not delete the user account, because the shared mailbox needs it as an anchor. If the mailbox must be kept for legal reasons, a shared mailbox on litigation hold needs an Exchange Online Plan 2 license, or Plan 1 plus Exchange Online Archiving.
OneDrive
When an account is deleted, its OneDrive is retained for a set period (30 days by default, configurable in the SharePoint admin center) and the manager can be given access. Move anything the business needs into a team SharePoint site before that window closes, rather than leaving business records in a former employee’s personal space.
Retention
If you use Microsoft Purview retention policies, content covered by a policy is kept according to that policy even after deletion. That is the reliable way to meet record-keeping obligations, rather than hoping someone remembered to export a mailbox.
Step 5: Clean up and confirm
Remove the user from distribution lists and security groups.
Remove the license and reduce your license count so you stop paying for it.
Update the global address list and any auto-replies that point customers to the right contact.
Check the sign-in logs in Entra over the next few days for failed attempts against the account.
Record the date and the person who completed each step. Auditors and cyber insurers increasingly ask for this.
For larger organizations, Microsoft Entra ID Governance includes Lifecycle Workflows that can automate many of these tasks when HR marks someone as leaving. For most mid-size firms, a documented checklist run by the same person every time is enough.
Does resetting a password sign a user out of Microsoft 365?
Not immediately on every device. Apps that already hold a valid token can continue for a time. Always revoke sessions in the Microsoft Entra admin center as well as resetting the password and blocking sign-in.
Should I delete a departed user’s account?
Not if you converted their mailbox to a shared mailbox, because the account anchors it. Block sign-in and remove the license instead. Delete the account only when you no longer need the mailbox or OneDrive content.
Can I remove company data from an employee’s personal phone?
Yes, if you used Intune app protection policies. A selective wipe removes company data from Outlook, Teams and OneDrive without affecting personal apps or photos.
Not confident your last few departures were fully closed off? Our free Microsoft 365 security assessment checks for leftover forwarding rules, stale admin roles and unmanaged devices.
Most businesses think offboarding means resetting a password and removing a license. That leaves the door open in half a dozen places: active sessions on phones, mail forwarding rules, app consents, personal devices still syncing files. This Microsoft 365 offboarding checklist walks through the steps in the order that actually cuts access, then preserves the data the business needs to keep.
Why the usual approach leaves gaps
A password reset does not end existing sessions. A phone that already holds a refresh token for Outlook can keep syncing mail for a while after the password changes. A laptop that was never enrolled in Intune keeps every OneDrive file it already downloaded. An inbox rule that forwards mail to a personal Gmail account keeps working until someone deletes it.
In the tenants I review, the most common offboarding gaps are:
None of these are exotic. They are just steps nobody wrote down.
Step 1: Cut access first (the first 15 minutes)
Do these steps at the moment the person is told, or immediately before for a sensitive departure. Order matters: stop new sign-ins, then kill existing ones.
Users > Active users, select the user and choose Block sign-in. In a hybrid environment, disable the account in Active Directory as well, or the next sync can undo cloud changes.Roles & adminsin Entra and any Privileged Identity Management eligible assignments, which are easy to miss.Step 2: Close the side doors
Attackers and unhappy employees both use the same quiet channels. Check each one.
Step 3: Deal with devices
What you can do here depends entirely on whether devices were managed. This is where an Intune rollout pays for itself.
If that last row describes most of your fleet, offboarding will always be incomplete. Our BYOD for Microsoft 365 approach uses app protection policies so you can remove company data from personal phones without touching anything personal, and Intune deployment brings company devices under management.
Step 4: Preserve the data the business needs
Once access is closed, protect what the person leaves behind.
Mailbox
Convert the user mailbox to a shared mailbox so a manager or successor can read it. The mailbox must still have a license when you convert it. After conversion, you can remove the license as long as the mailbox is under 50 GB. Do not delete the user account, because the shared mailbox needs it as an anchor. If the mailbox must be kept for legal reasons, a shared mailbox on litigation hold needs an Exchange Online Plan 2 license, or Plan 1 plus Exchange Online Archiving.
OneDrive
When an account is deleted, its OneDrive is retained for a set period (30 days by default, configurable in the SharePoint admin center) and the manager can be given access. Move anything the business needs into a team SharePoint site before that window closes, rather than leaving business records in a former employee’s personal space.
Retention
If you use Microsoft Purview retention policies, content covered by a policy is kept according to that policy even after deletion. That is the reliable way to meet record-keeping obligations, rather than hoping someone remembered to export a mailbox.
Step 5: Clean up and confirm
For larger organizations, Microsoft Entra ID Governance includes Lifecycle Workflows that can automate many of these tasks when HR marks someone as leaving. For most mid-size firms, a documented checklist run by the same person every time is enough.
Microsoft’s own guidance is in Remove a former employee from Microsoft 365.
Frequently asked questions
Does resetting a password sign a user out of Microsoft 365?
Not immediately on every device. Apps that already hold a valid token can continue for a time. Always revoke sessions in the Microsoft Entra admin center as well as resetting the password and blocking sign-in.
Should I delete a departed user’s account?
Not if you converted their mailbox to a shared mailbox, because the account anchors it. Block sign-in and remove the license instead. Delete the account only when you no longer need the mailbox or OneDrive content.
Can I remove company data from an employee’s personal phone?
Yes, if you used Intune app protection policies. A selective wipe removes company data from Outlook, Teams and OneDrive without affecting personal apps or photos.
Not confident your last few departures were fully closed off? Our free Microsoft 365 security assessment checks for leftover forwarding rules, stale admin roles and unmanaged devices.