Microsoft 365 Employee Offboarding Checklist

Take decisions first: access, data and license

There are three different decisions at the time of leaving here: what systems you work will be disconnected, who will take over their data and which licenses will be released. It can lead to unnecessary data loss or open access to address such as a single user delete process. Microsoft old employee account management guide also addresses access blocking, data protection and uninstalling account as separate steps.

Quad Bilişim’s proposal is a single task record opening for each individual. You will find the authorized request in the registration, walking time, account ID, person and closing officer to take over data. Only the necessary information to the technical attachment; Do not add all the staff file to support request. If there is a suspicious account event, create a separate event intervention from the normal rev flow.

• Access closure approval: human resources or authorized manager.
• File and mail patrol approval: the corresponding business unit and data controller.
• Technical application and evidence: authorized IT personnel.

1. Block sign-in and also address existing sessions

Verify the correct user in the management center; pay attention to similar names or common accounts. The effective user record in the Microsoft 365 management center is blocking login, password reset and exit operations from all sessions. The role of the manager used should be sufficient to the target account; should not be given unnecessary high authorization for daily operations.

Microsoft’s access blocking stepexplains that these processes may not be concluded simultaneously in every application. So I blocked the “he was blocked, closed instantly everywhere” and do not close the record with assumption. Plan local directory responsibilities with cloud side in synced environments with Local Active Directory.

In addition Microsoft Entra access cancellation documentIt states that the application may be different from Entra sessions with its own session cookies. You may need separate sessions or user cancellation in CRM, VPN and other SaaS applications. Check the local application accounts that are not linked to corporate account from inventory.

Closing measure: IT controller writes the task record where blocking is applied and the sessions of critical applications are also reviewed. There is no revolution by giving the password of the old user to another employee.

2. Choose email handover arrangements according to business needs

How to transfer email depends on the needs of the enterprise. Only if new messages are asked to reach another responsible; If you need team access to past correspondence, the shared mailbox options are evaluated. These do not produce the same results. Microsoft mail patrol guide Based on the redirecting carries new incoming messages, conversion to the shared mailbox can protect old mail and calendar information.

The shared mail box is not licenseed in any condition: size and archive or storage properties used should also be checked. It reminds that the user account connected to the same document, routing or shared mail box should not be deleted. Therefore, the decision to remove license or account should be given after correcting the selected mail method.

Our operation proposal is to determine the written date of inherited person and access finish. Do not open any external redirect; Do not carry customer correspondence to personal email addresses. Specify the new responsibility of meetings and room reservations in the calendar. Structure the Devir test institution with approved method; This guide will not automatically start any real email submission.

3. Plan ownership before deleting OneDrive files

The offer file or project folder, which stands in the OneDrive area of a person, can remain in line with the closure of the account. Remove the list of work data first; Decide what content will be moved to the common team area and who will access. Give all personal space limited authorization to need to open to everyone.

Microsoft OneDrive and Outlook data patrol guideexplains the provision of authorized access to old user's files and the transportation of files that will be protected. In the document, there is a warning that files with version history can only be transferred to the last version in the process of carrying or copying. Verify that the version history is really protected by choosing if important in terms of work.

Since the deleted users are associated with OneDrive storage time for tenant settings, do not move by relying on a single time seen on the internet. Check the current storage setting and applied protection policies of the institution. Add file list, new location, access holder and sample opening test to closing record. After the temporary admin access is finished, you are removed.

Withdrawal, archiving and storage decisions should be given by the authorities of the organization. This content does not recommend a certain legal retention period; Take a look at the specialist of your institution for private obligations.

4. Remember devices and access outside Microsoft 365

The following list is the operational control proposal of Quad Bilişim; The Microsoft product document does not replace the mandatory steps. Apply by selecting systems in your inventory.

• Devices: Save the delivery status of laptop, phone and security switches.
• Network access: Check VPN, remote support and wireless network IDs.
• Business applications: Review CRM, accounting, file sharing and user portals.
• Official Accounts: Set the new responsible for automations or service accounts that employee manages.
• Common access: Prepare a safe replacement plan by reviewing dependencies if there is a really shared secret.

The delivery of the company device is not the same operation with enterprise data located on the personal device. Returning like remote deletion should not be started without the correction of difficult operations, device ownership and authorization. Changing the password of common automations without plans can also stop the work of other teams. For this reason, it provides a safer workflow to save one of the “fixed” or “necessed” states for each access.

5. Estimate the last license and close the job with evidence

It is useful to reduce the cost of license; but it is not the right start to remove license without certain how to transfer mail and file required to be protected. User delete, license removal and mail box conversion are different processes. The possibility and service effect should be assessed through the selected process and institution settings.

The closing control we have avoided should respond openly to four questions: what happened to old access? Who was transferred to the business data? Who is the device and application responsibilities? When is the end of temporary access? The person who implements for each line is more practical to have the control time and short proof note, after months it is trying to rebuild the process.

Sample task record: “The session barrier for the sale account was checked; customer folders were determined as a sales manager; mail tip decision is expected; The license process was left after this decision. In this example, the uncertainty is not stored and completed, the step will not be accidentally closed.

Applying the opposite of the same template to beginners, which makes it easier to monitor what access is caused. The basic components of Microsoft 365 and IT external welding work model you can clear the responsibilities in the process by reading.

Frequently Asked Questions

Can I delete the account of the person assigned here immediately?

The same decision to delete the account with closing login access. Before mail and file transfer, applied storage policies and the status of connected services is verified; account removal decision should be given by the competent responsible after that.

Does password reset instantly remove from all applications?

There is no such warranty for each application. Open sessions, access tokens and applications can work differently. Critical third-party applications should also be checked alongside Microsoft 365 and Microsoft Entra steps.

Can I apply this control list to my IT service provider?

If your institution defines the required authorization and open responsibilities, technical application may be given to IT service provider. Data transfer and storage decisions should still be in the authorized persons of your organization; transactions made should be taken in boiling.

Technical resources

• Microsoft: Remove old employee and protect data
• Microsoft: Blocking login
• Microsoft Entra: Cancel user access
• Microsoft: Email patrol and shared mail box
• Microsoft: OneDrive and Outlook data patrol

Source control: 18 October 2026. Task records and operation examples are the original recommendations of Quad Bilişim; official is not a Microsoft standard or security guarantee.