What should be included in a thorough Microsoft 365 offboarding process?
Asked by
MellowCedar47
When an employee leaves, the obvious steps are disabling sign-in, revoking sessions, handling email and OneDrive, removing group memberships, and reclaiming licenses. But I'm concerned about less visible dependencies, such as Power Apps, Power Automate flows, authentication connections, SharePoint ownership, Power BI workspaces, scheduled tasks, delegated access, and other services tied to the user's account. What does a reliable offboarding process look like, and how do you identify these dependencies without manually checking every Microsoft 365 admin center?
Answers
A checklist or automation is much safer than relying on memory. We export the user’s group memberships, ownership, delegated access, licenses, SharePoint permissions, and mailbox access, then send the ownership report to the manager for review. The manager confirms what must be retained, transferred, forwarded, or backed up. We use a staged process: disable access immediately, preserve or transfer data according to legal and retention requirements, leave the mailbox and OneDrive available for an approved period, then remove licenses and delete the account only after the review window expires. Automation can handle the repetitive account changes, but management still needs to identify which business processes depend on the person.
Reply to this answer
The most important part is transferring ownership before the account is disabled. Check Microsoft 365 groups and Teams, SharePoint sites, OneDrive files, Power BI workspaces, Forms, Bookings, shared mailboxes, calendars, contacts, app registrations, RBAC roles, scheduled tasks, scripts, and any third-party identity providers. Power Platform deserves special attention: flows may continue running temporarily through the departing user’s connections, then silently fail when those credentials expire. Reassign orphaned flows and app connections to a service account or group-owned identity, and make sure every important SharePoint site and business process has at least two appropriate owners. Also look for undocumented scripts or scheduled jobs running under the employee’s credentials.
Reply to this answer
Start with the security basics: confirm the termination request and correct identity, change or reset the password, block sign-in, revoke active sessions and refresh tokens, remove authentication methods, wipe company data from managed or BYOD devices, and disable the account in both on-premises Active Directory and Entra ID when applicable. Remove group memberships, revoke licenses, hide the mailbox from address lists, and remove other product licenses. If there is a mailbox to retain, convert it to a shared mailbox, configure an out-of-office message and approved delegates, and remove personal forwarding. Keep a documented retention period before deleting anything.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions