An employee is leaving: The IT checklist for their last working day

An employee leaves your company, returns their laptop and says goodbye. That does not automatically end their IT access. This employee offboarding checklist helps you prepare before their last working day, carry out the agreed changes and verify the result afterwards. That includes the Microsoft 365 deadlines that decide what happens to the mailbox and OneDrive.

Who is it for? Management, office administration and IT in small and medium-sized businesses. The outcome: A documented request with named owners, blocked access and a verified data handover. Your IT team handles the technical work; you use this list to coordinate the preparation.

An example: The laptop is back, but the supplier portal still works

Imagine a fictional trade business: A purchasing employee leaves on Friday at 3 pm. Their laptop is in the office. A colleague takes over their orders but cannot find the latest quotation list. Meanwhile, the departing employee's separate supplier portal account still works.

The example highlights two tasks that belong together: ending access that is no longer needed and enabling the remaining team to keep working. Neither requires sharing the former employee's password or granting blanket access to all their email.

Why something is so easily left open

Access builds up over the years in many places: the central account, portals, shared passwords and devices. HR, the line manager and IT each know only part of it.

Microsoft 365 adds another layer: blocking sign-in, removing the licence and deleting the account are separate steps with their own deadlines. Done in the wrong order, they can cost you exactly the data the successor needs.

Before the last working day: Agree the request and handover

1. Name an owner and set the time

Create one central record, such as a ticket. Include the employee's name and account identifier, last working day, exact time for blocking access, responsible manager, IT contact and successor. If someone is released from duties earlier, their technical departure may precede the end of their contract. The authorised decision-maker sets the time; IT does not decide it independently.

Assign the tasks: HR reports the departure, the line manager identifies the business data needed and IT implements approved changes. One person follows up outstanding items.

2. List accounts, devices and dependencies

Review existing documentation with the manager and employee. Include at least:

• Windows/AD accounts, Microsoft 365 and additional administrator accounts;
• VPN, remote access, business applications and cloud telephony;
• supplier, customer and accounting portals, plus the password manager;
• laptop, smartphone, tokens, keys and accessories;
• shared accounts as well as devices, services and notifications running under the personal identity, such as scan-to-email on the multifunction printer or backup reports.

A portal with its own login needs a separate action. Include recovery addresses and phone numbers associated with business accounts.

Also check whether the responsible manager is recorded in the user's Microsoft Entra ID profile. This determines who automatically gets access to the OneDrive once the account is deleted (see "Frequently asked questions").

3. Hand over business data in advance

Ask the manager to identify the projects, files, appointments and contacts the successor needs. Where possible, move required documents together into an approved team location before the departure. Test one specific document with the successor, in the example the outstanding quotation list: Can they open and edit it?

Mailbox access and potentially private content require agreed approval; technical administrator rights alone do not provide approval to read content (see "Retention and private email").

At the agreed departure time: Block access and end sessions

The central identity is the most important starting point. Microsoft's access revocation guide describes these steps:

1. On-premises Active Directory (hybrid environments only): Disable the account and reset the password twice. Microsoft gives the pass-the-hash risk as the reason; if the account is safely not compromised, one reset is enough.
2. Microsoft Entra ID: Disable the account so that no new sign-in is possible, then select "Revoke sessions".
3. Verification: IT checks the actual state on both sides instead of waiting for the next synchronisation when blocking is time-critical. Cloud-only accounts skip step 1.

The person then receives no new tokens. Access tokens already issued remain valid for up to one hour by default, and Entra ID cannot directly revoke an application's own sessions. Immediate sign-out everywhere is therefore not guaranteed.

Also address VPN, remote access, portals with their own login and separate administrator accounts. Agree how to handle MFA methods, security keys and recovery options; returning an MFA token does not replace blocking the account. The successor works with their own account and specifically assigned permissions, never with the old login. In the trade business from the example, the supplier portal belongs right here: The purchaser's account is disabled at the portal and the colleague gets their own.

Email, OneDrive and Teams: Arrange the handover before deleting

Mailbox and calendar

Define who receives approved access, its scope and its end date. An agreed automatic reply can point to the new contact. Review recurring meetings and room bookings so the successor can take over or reorganise them.

A shared Exchange Online mailbox is a common solution. According to Microsoft's mailbox conversion guidance:

• Email, calendar and inbox rules are retained. Check existing rules such as forwarding.
• Without a password reset, the old credentials keep working. Conversion does not replace blocking.
• The mailbox still needs its licence to be converted. Afterwards the licence can be removed if the mailbox is smaller than 50 GB; with Exchange Online Plan 2, 100 GB is possible.
• An auto-expanding archive or a litigation hold also requires a suitable Exchange licence here.
• The user account stays in place because it anchors the shared mailbox.

In Exchange hybrid deployments, IT also checks the on-premises configuration.

Retention and private email

Brief orientation, not legal advice. Business emails may be subject to retention requirements. For German businesses, section 147 of the Fiscal Code generally sets six years for received and sent commercial or business letters and eight years for accounting vouchers, each counted from the end of the calendar year. Whether an email falls into these categories depends on its content. Before deleting a mailbox, check whether an email archiving solution has already stored the relevant messages securely.

If private use of the business mailbox was permitted or tolerated over a longer period, things get more delicate. The guidance of the German data protection authorities then assumes that the employer is bound by the secrecy of telecommunications and may in principle only access the mailbox with consent. The paper dates from 2016 and itself cites court decisions taking a different view; the question is not conclusively settled.

Even where the mailbox is for business use only, the guidance says the employer may only access it as far as business purposes require and must not keep reading messages recognised as private. For absences, it recommends an automatic reply first; automatically forwarding every message is not a sensible default. Clarify open questions with your data protection contact and legal advisers.

Files and ownership

Seeing a link in Teams does not establish who owns the file: According to Microsoft Support, channel files are stored in the team's SharePoint, while files from chats are stored in the uploader's OneDrive. Check the actual locations, sharing permissions and team owners.

For OneDrive, removing a licence is not a retention solution. According to Microsoft's documentation on unlicensed accounts, an unlicensed OneDrive becomes read-only after 60 days and is archived after 93 days by default. In both states, neither admins nor users can access the content until an admin, for example, assigns a licence or reactivates the archive through paid billing. Plan the handover before removing the licence and document the destination and access test.

After departure: Check shared secrets, devices and licences

Remove the person from shared password collections. Change shared credentials that would otherwise remain usable, checking dependent devices and applications first. Revoking vault access does not erase a password someone already knows. Our guide to password security in the workplace covers the basics. With a central password manager such as Managed Password, you can remove an individual employee's vault access with just a few clicks. Passwords they already know still need to be changed.

Record returned devices, including asset number and condition. Before reassignment, required business data is secured or handed over and devices are cleaned using the approved procedure. For personal devices, establish which business areas may be removed. Our guide to Mobile Device Management for SMEs explains the organisational foundations.

A missing or switched-off device remains an open item: Blocking an account does not remove local files, and according to Microsoft, a remote wipe through Microsoft Intune only takes effect once the device is online. A submitted request alone is not evidence of completion.

Review licences after the data handover and clarification of any retention needs. An available licence can be reassigned; fewer assigned users do not automatically mean lower contractual costs.

Employee offboarding checklist to copy

Replace roles with actual names and record approvals, timestamps and evidence in the ticket; a tick alone does not explain what was done.

Check	Owner	When
Blocking time approved	Manager	Before
Accounts and devices listed	IT + office team	Before
Services moved to service account	IT	Before
Data handover approved	Manager	Before
Successor access tested	Department	Before
AD/cloud accounts blocked	IT	Exit day
Sessions and MFA checked	IT	Exit day
VPN and portals addressed	IT + department	Exit day
Mailbox and meetings agreed	Manager + IT	Exit day
File sharing checked	Department + IT	Exit day
Devices collected	Office team	Exit day
Shared credentials changed	IT + department	After
Licences and contracts reviewed	IT + purchasing	After
Completion documented	Coordinator	After

When is offboarding complete?

When the responsible people have confirmed completion and every outstanding task has an owner and a deadline, such as a missing smartphone or an unreachable portal provider. A planned action is not a completed one. A brief completion record is enough: Who blocked which account and when, who checked the handover, which exception remains open? Passwords do not belong in the ticket.

Common offboarding mistakes

The licence goes before the handover. A typical sequence: The licence is removed on the exit day before the handover is complete. Afterwards, the successor looks for supplier quotations that were only in the former employee's mailbox, in the trade business from the example, say, the quotations behind the quotation list. According to Microsoft's overview, email, contacts and calendar are retained for 30 days after the licence is removed and then permanently deleted. During that time, the licence can be reassigned, for example to convert the mailbox after all. The safer order: handover and access test first, then the licence.

Services run under the personal account. A common pattern: The former employee's account is blocked and deleted. Weeks later, someone notices that the multifunction printer no longer emails scanned documents and that reports, for example from the backup system, no longer arrive. Both relied on that person's credentials. Move such devices, services and notifications to an agreed service account beforehand and test delivery. The same applies to scheduled data exports.

Only Microsoft 365 was considered. Walk through the list from the perspective of everyday work: Who orders materials, publishes job vacancies or manages the telephone greeting? Include social media accounts, newsletters, domain administration and external file sharing. If the departing employee is the only administrator there, set up an authorised successor first.

When outside help makes sense

You can manage a single departure yourself with this list. Support pays off when nobody in-house is confident with Microsoft 365 administration, departures happen regularly or an on-premises Active Directory is involved.

We look after more than 1,500 endpoints and more than 300 servers. For Microsoft 365, we take over ongoing management on request, from user on- and offboarding to licence adjustments and changes to Teams and sharing structures, including in existing environments: Microsoft 365 rollout and ongoing management. Our Permissions & Sharing Management for Microsoft 365 continuously reviews external shares as well as guest and anonymous access in SharePoint, Teams and OneDrive. With Mobile Device Management, you can remove company data from mobile devices when someone leaves, depending on device type and enrolment method.

Our guide to Managed Services explains how such tasks fit into ongoing IT support; additional protective measures form part of our IT security services.

Frequently asked questions

How long can a deleted user account be restored?

In Microsoft 365, for 30 days. During that time, Microsoft retains the mailbox and OneDrive content, and you can restore the account together with its content. Accounts synchronised from an on-premises Active Directory are deleted and restored there, not in Microsoft 365.

Does the manager automatically get access to the OneDrive?

By default, yes, once the account is deleted, provided the manager is recorded in the Entra ID profile. If not, a designated secondary owner gets access. If neither is set or access delegation is disabled, nobody gets automatic access. OneDrive retention is 30 days by default. After that, the OneDrive stays in the recycle bin for 93 days and can only be restored using PowerShell.

Is forwarding the email to the successor enough?

Targeted forwarding can help for new messages sent to the old address; Microsoft lists it as a way to keep the address reachable for customers and partners. For absences, the data protection authorities recommend an automatic reply first. For earlier business emails, a shared mailbox with a defined group of people is usually the better fit. A deleted account no longer receives email.

When can the licence be removed?

Only after the handover, the access test and a decision on the mailbox. Otherwise Microsoft permanently deletes email, contacts and calendar after 30 days. A shared mailbox under 50 GB works without a licence after conversion; an unlicensed OneDrive becomes read-only after 60 days and is archived after 93 days.

Conclusion

Clean offboarding follows a clear order: block access immediately, hand over and test the data, only then remove the licence and finally delete the account, unless a shared mailbox depends on it. In the trade business from the example, that would have been enough: portal access blocked, quotation list in the team location, mailbox handed over before the licence goes.

Would you like to agree a consistent offboarding process for your business? Arrange a free initial consultation.