Most offboarding gaps start with a forgotten account. But an active login for a former employee is an open door, whether they use it or an attacker does. A consistent checklist closes it every time.
On the last day
- Block sign-in and reset the Microsoft 365 password
- Sign the user out of all sessions and remove their MFA methods
- Remove company data from their phone or wipe company-managed devices
- Disable remote access, VPN, and any shared logins they knew
- Collect laptop, badge, keys, and security tokens
Within the first week
- Convert the mailbox to a shared mailbox or set up forwarding for their manager
- Transfer OneDrive files and ownership of Teams and SharePoint content
- Remove them from vendor portals, banking, and line-of-business apps
- Change passwords for any shared accounts they used
- Reassign or release licenses so you stop paying for them
Make it a habit: ask HR to notify IT as soon as a departure date is known, so nothing depends on memory.
Don’t forget onboarding
A good offboarding process starts at onboarding. Tracking which apps, groups, and devices each person receives on day one makes it simple to remove everything on their last day.