When someone leaves: the IT offboarding checklist.

When someone joins a business, there is usually a plan. A laptop is ordered, accounts are set up and someone shows them around. When someone leaves, IT often gets a quick email on their last afternoon, if it gets one at all.

That gap matters. A former employee with a working account is a security risk, even when they left on good terms, because nobody is watching that account any more. It is also a cost, because licences keep billing until someone removes them. And it is a continuity problem, because the files and emails they leave behind still belong to the business.

Here is the checklist we work through, in the order it usually needs to happen.

Before their last day

• Tell IT early. A week's notice turns offboarding into a planned job rather than a scramble. For a dismissal, IT needs to know before the conversation happens, so access can be removed at the same time.
• Decide who inherits what. Who takes over their email, their files, their open projects and their supplier relationships? Agree it with their manager before they go.
• Hand over shared knowledge. Passwords they hold in a password manager, logins for supplier portals, and anything only they know how to do. If your business uses a business password manager, shared items should already sit in shared vaults rather than personal ones.
• List what they have. Laptop, phone, security keys, access cards, and any software or subscriptions in their name.

On their last day

• Block sign-in to their Microsoft 365 account at the agreed time, and reset the password.
• Revoke active sessions so they are signed out of email and apps on every device, including personal phones.
• Remove their MFA methods so the account can't be recovered with their phone.
• Collect the devices. If a device can't be returned the same day, use your device management tools to lock or wipe it remotely.
• Remove building and physical access, including alarm codes and access cards.

In the first week

• Deal with the mailbox. The usual approach is to convert it to a shared mailbox and give their manager or replacement access. Shared mailboxes under 50 GB don't need a licence, so this keeps the email without the ongoing cost. Set an automatic reply telling senders who to contact instead.
• Move their OneDrive files. Anything the business needs should be moved to a SharePoint site or a colleague's OneDrive. Don't leave this for later (see the licence note below).
• Remove them from groups, distribution lists and Teams, and transfer ownership of any Teams or SharePoint sites they owned.
• Change shared credentials they knew, such as the Wi-Fi password, shared admin accounts and supplier portal logins.
• Close or transfer accounts outside Microsoft 365: the accounting system, CRM, line-of-business applications, social media and any cloud services they signed up for.

A note on licences and OneDrive

Removing someone's Microsoft 365 licence is how you stop paying for them, but it starts a clock on their files. Under Microsoft's current rules, a OneDrive account without a licence becomes read-only after 60 days and is archived after 93 days, and getting archived data back carries a charge. So decide what happens to their files, and move them, before you remove the licence.

Once the files and mailbox are sorted, remove the licence or reassign it to a new starter. Paying for licences nobody uses is one of the most common bits of waste we see when we review a business's Microsoft 365 setup.

Within the month

• Check nothing was missed. Review sign-in logs for the account, and look for any forwarding rules or app access that are still active.
• Wipe and reissue the laptop, or retire it if it's due for replacement.
• Update your records, including the asset register, licence register and any documentation that named them as the contact for a system.
• Delete the account once the business is confident it has everything it needs.

Make it a process, not a memory

The businesses that offboard well don't rely on someone remembering the steps. They have a short checklist that HR or the manager starts as soon as a resignation comes in, with IT as a named step. If you work with a managed service provider, it should be able to run the technical side for you from a single request, and confirm in writing when each step is done.

If you'd like a hand building an offboarding process, or want us to run it for you, our Microsoft 365 management and device management teams can help, or you can get in touch.