Microsoft 365 offboarding: the day-one checklist

Microsoft 365 offboarding is the sequence run on the day an employee leaves: block sign-in and revoke active sessions in Microsoft Entra ID, reset authentication methods and registered devices, wipe company data from managed hardware, preserve the mailbox and OneDrive, remove group and app access, then reclaim the licence. Order matters, and the identity steps come first.

Many businesses run the process in exactly the wrong order. IT hears about the departure days later, the licence gets pulled first because it costs money, and the account that can still sign in from a personal phone is dealt with last. The order below is deliberate: identity first, data second, licence last.

Why block sign-in and revoke sessions at the same time?

Blocking sign-in in Microsoft Entra ID stops the account from being issued new tokens. It does not touch the tokens already issued. By default, access tokens issued by Entra ID last for one hour, and until they expire the leaver's Outlook, Teams and browser sessions keep working as though nothing happened. That is why Microsoft's own guidance for employee termination pairs the two actions: disable the account, then revoke the sessions.

Both actions sit on the user's account in Microsoft Entra ID: clear Account enabled under the account status, then select Revoke sessions on the user overview. Revoking sessions invalidates the refresh tokens, so when each access token expires within the hour, the application cannot silently renew it and the sign-out sticks. For applications enrolled in Continuous Access Evaluation, revocation lands in near real time rather than at token expiry.

Hybrid environments have a third step. If the account synchronises from on-premises Active Directory, disable it there as well and reset its password twice. Microsoft recommends the double reset to close off pass-the-hash attacks while password replication catches up.

What happens to multifactor authentication methods and devices?

An offboarded account should not be able to prove its identity again, which means the registered multifactor authentication (MFA) methods have to go too. In Microsoft Entra ID, the Require re-register MFA action deactivates the user's hardware OATH tokens and deletes their registered phone numbers, Microsoft Authenticator apps and software OATH tokens in one step. Any app passwords the user created for legacy clients should be deleted at the same time, because app passwords bypass MFA entirely and non-browser apps keep accepting them until they are removed. Microsoft's revocation guidance also includes disabling every device registered to the user in Entra ID.

Company data on the hardware itself is an Intune decision, and the right action depends on who owns the device. A company-owned laptop that is not coming back gets a wipe, which resets it to factory settings; data on the device cannot be recovered afterwards. A personal phone the employee enrolled themselves gets the narrower treatment: wiping corporate data from the managed apps while leaving photos and personal apps untouched. One operational caveat from Microsoft's guidance applies to both. The device must be online to receive the command, and an offline device keeps whatever is stored locally until it next connects.

Should the mailbox become a shared mailbox?

For most leavers, yes. Converting the user mailbox to a shared mailbox keeps every email and calendar item, keeps the address alive for customers who still write to it, and lets whoever inherits the work read and send from it. The alternative, forwarding to a colleague, suits short handovers where nobody needs the history. The two combine well: the shared mailbox holds the record while forwarding pushes new mail to the successor.

The licensing mechanics are where the sequence earns its keep. The mailbox must still hold a licence at the moment of conversion, and the licence can be removed once the conversion completes. Below 50 GB, the shared mailbox then needs no licence at all. Above 50 GB it needs an Exchange Online Plan 2 licence, which lifts the limit to 100 GB, and a mailbox that has to sit under litigation hold needs an appropriate licence regardless of size.

How long does OneDrive keep a leaver's files?

OneDrive retention runs on a clock that starts only when the user account is deleted from Microsoft Entra ID. Blocking sign-in does not start it, and neither does removing the licence. Once the account is deleted, the OneDrive is kept for 30 days by default, and the retention period can be set anywhere from 30 to 3,650 days (10 years) in the SharePoint admin settings.

During that window, access is delegated automatically. The leaver's manager, as recorded in Entra ID, is granted access to the OneDrive and emailed about it, with a configurable secondary owner as the fallback when no manager is set. Seven days before the retention period expires, a reminder email goes out. After expiry, the OneDrive moves to the site collection recycle bin for a further 93 days, where shared content stops being accessible and nothing is indexed for eDiscovery searches.

The practical move is not to rely on the window at all. Before the account is deleted, move anything the business needs out of the leaver's OneDrive into a Teams or SharePoint library owned by the team, because files that live in a personal OneDrive leave with the person. The retention window is the safety net, not the filing system.

What group, Teams and third-party access needs removing?

Group membership is how most access is actually granted, so removing the leaver from every Microsoft 365 group, security group, Teams team and distribution list is what closes doors to SharePoint sites, shared mailboxes and internal applications. Where the leaver owned a team, a site or an automated workflow, ownership needs to transfer before the account goes, or the resource is orphaned with nobody able to administer it.

Third-party applications are the part Entra ID cannot fully reach. When a user signs in to an outside application with their work account, that application often issues its own session token, and Microsoft is explicit that Entra ID cannot revoke a session token issued by another application. Blocking the account stops the next sign-in; the current one runs until the app's own session expires or the app is told to end it. Microsoft's recommended answer is automated deprovisioning through Entra ID app provisioning, which typically runs every 20 to 40 minutes, plus a maintained list of the apps that have no provisioning hook and need a human to remove the account.

When does the licence come off, and can the seat be cancelled?

The licence comes off last, after the mailbox is converted and the OneDrive handover is arranged. Removing it earlier blocks the shared-mailbox conversion and achieves nothing that blocking sign-in has not already achieved. If a licence is removed without converting the mailbox first, Microsoft retains the email, contacts and calendar for 30 days and then deletes them permanently, so the conversion decision cannot be left for later.

Whether the freed seat can stop being paid for is a separate question, and the answer depends on the subscription term. Under the new commerce experience rules that now govern Microsoft 365 subscriptions bought through Cloud Solution Provider partners, the number of licences on a subscription can only be decreased within the first seven days of those licences being added, whether they were added at initial purchase, at renewal or mid-term. Outside that window, an annual-commitment seat count cannot be reduced until the next renewal, though the reduction can be scheduled in advance so it takes effect the moment the term rolls over.

In practice, offboarding does not shrink the Microsoft 365 bill on the day someone leaves. It frees a seat for the next starter, and it adds a line to the list of reductions to make at renewal. Businesses that never reconcile leavers against their subscription counts renew the same quantity year after year, which is how a tenant ends up paying for more seats than it has staff. Subscription terms are a detail Frontrow tracks for managed services clients, with a renewal calendar and a seat count that reflects reality.

What should the offboarding record show?

Every step above should leave a trace: who requested the departure, when sign-in was blocked and sessions revoked, which devices were wiped and when the command was confirmed, where the mailbox and OneDrive went, which groups and applications were removed, and when the licence came off. Auditors and cyber insurance questionnaires ask the same question in different words: can the business show that a leaver's access was removed promptly, every time? A checklist run from a ticket, with timestamps, answers it. A process run from memory does not.

One legal check belongs at the start rather than the end. If the departure is contentious or a dispute is plausible, place the mailbox and OneDrive under a hold through Microsoft Purview eDiscovery before anything is deleted. Microsoft's documentation is clear that retention policies and holds take precedence over the standard deletion clocks described above, which makes the hold the one step that can wait for nothing.

How fast should the identity steps run for a hostile departure?

Minutes, not days. For a resignation on good terms, running the identity steps within the hour of the farewell is hygiene. For a termination, a dispute, or anyone with privileged access, the block-and-revoke pair should execute while the conversation is still happening — the one-hour access token lifetime means every minute of delay is a minute of live access to mail, files and customer data from any device the person owns.

Privileged accounts deserve extra paranoia. Admin roles should be removed first, before the account block, so that even a live session cannot undo the offboarding as it happens. This is also the scenario where the earlier caveats compound: an offline laptop that has not yet received its wipe command, a third-party app holding its own session, a shared mailbox still answering to the old password. The checklist is the same; the tempo is not.

What is the complete day-one checklist?

1. 1Confirm the departure with HR or the manager, note the time, and decide whether the exit is contentious enough to need a Microsoft Purview hold before anything else runs.
2. 2Remove any admin roles, then block sign-in in Microsoft Entra ID and revoke sessions in the same sitting. In hybrid environments, disable the on-premises Active Directory account and reset its password twice.
3. 3Require MFA re-registration to strip the registered authentication methods, delete any app passwords, and disable the devices registered to the account.
4. 4Issue the Intune actions: a full wipe for company devices that are not coming back, removal of corporate data from managed apps on personal devices, and a note against any device that is offline and still pending.
5. 5Convert the mailbox to a shared mailbox while the licence is still assigned, reset its password, and set forwarding or delegate access for whoever inherits the work.
6. 6Move OneDrive content the business needs into a team-owned SharePoint or Teams library, and confirm the manager or a secondary owner holds delegated access to the rest.
7. 7Remove the leaver from all groups, teams and distribution lists, and transfer ownership of any team, site or workflow they owned.
8. 8Remove the account from third-party applications, starting with the ones that hold their own sessions and have no automated deprovisioning.
9. 9Remove the Microsoft 365 licence once the mailbox conversion is confirmed, and return the seat to the pool for the next starter.
10. 10Log the seat against the next subscription renewal so annual-commitment quantities can be reduced when the term allows.
11. 11Decide the account's end state: keep it, blocked and unlicensed, while it anchors a shared mailbox, or delete it once the mailbox and OneDrive handovers are complete, knowing deletion starts the OneDrive retention clock.
12. 12Close the ticket with timestamps against every step, so the record exists before anyone asks for it.

Run rehearsed, the whole sequence is a 15-minute job. Run cold, it is a week of loose ends and a security gap the whole time. Frontrow operates it as a standing runbook inside its managed services agreements: departures notified through a single channel, identity steps executed the same hour, handovers documented, and the licence ledger reconciled at every renewal.