Onboarding a new starter is a scheduling problem. Offboarding a leaver is a security problem — and the difference is that nobody notices when you get offboarding wrong. The account looks disabled, the ticket gets closed, and the access quietly stays open. Here is the full checklist in the order it should run, which four steps get skipped almost every time, and the PowerShell for each.
First, the order matters
Offboarding steps are not a shopping list you can do in any sequence. Revoking a licence before you convert the mailbox destroys the mailbox. Deleting the account before you transfer OneDrive ownership destroys the files. The order below is deliberate — cut access first, preserve data second, tidy up third, delete last.
Phase 1 — Cut access (do this in the first five minutes)
1. Block sign-in
The first move, before any data work. In Entra ID or with Graph PowerShell:
Update-MgUser -UserId [email protected] -AccountEnabled:$false
2. Revoke active sessions ← forgotten #1
This is the big one. Blocking sign-in stops new authentications. It does nothing to the access token already sitting in the leaver's Outlook, Teams or phone — that stays valid until it expires, typically up to an hour, and the refresh tokens behind it can last a great deal longer.
Somebody walked out at 9am with a live session can still be reading mail at 9:45 unless you run this:
Revoke-MgUserSignInSession -UserId [email protected]
3. Reset the password
Belt and braces. Set it to something random nobody has, so that re-enabling the account by accident does not hand it back.
4. Revoke OAuth application consents ← forgotten #2
The one almost nobody does. If your leaver ever clicked "Accept" on a third-party app — a mail client, a CRM connector, an AI notetaker — that app holds its own token against their identity. Blocking sign-in does not touch it.
Check what they granted, then remove it, in Entra ID under the user's Applications, or via the oauth2PermissionGrants Graph endpoint. On a departure that ended badly, this is the first thing to look at, not the last.
5. Remove MFA methods ← forgotten #3
A registered authenticator on a personal phone is a live credential. If the account is ever re-enabled — for a rehire, or by mistake — that method still works. Clear the authentication methods rather than leaving them attached.
6. Strip group memberships
Groups are where access actually lives: shared mailboxes, SharePoint sites, Teams, licence assignment, conditional access exclusions. An account can be disabled and still be sitting in a group that grants something.
7. Remove from privileged roles
Check directory roles separately from groups. A leaver who was a Global Administrator or an Exchange Administrator needs that removed explicitly, and it should show up in your audit trail when it happens.
Phase 2 — Preserve the data (before anything is deleted)
8. Convert the mailbox to shared
Do this before revoking the licence. A shared mailbox under 50 GB needs no licence, so this both preserves the mail and frees the seat:
Set-Mailbox -Identity [email protected] -Type Shared
9. Grant the manager access to the mailbox
Somebody has to answer the customer emailing a person who left. Add the manager as a delegate rather than forwarding — forwarding to an individual is a data-handling problem waiting to happen.
10. Transfer OneDrive ownership ← forgotten #4
OneDrive content is deleted with the account, on a retention timer most people have never checked. Set the manager as secondary owner, or move what matters to SharePoint, before the account goes.
11. Reassign owned resources
Teams they solely owned, SharePoint sites, Planner plans, Power Automate flows, shared calendars. An ownerless Team is a problem you discover months later when nobody can change its membership.
12. Deal with mail flow
Set an auto-reply naming who to contact instead, or forward to the manager for a fixed window with an end date in the ticket. Do not leave a permanent silent forward — that is how mail keeps flowing to somebody who has left the company.
Phase 3 — Devices and licences
13. Handle the device
Retire or wipe in Intune. Retire removes company data and leaves personal data alone, which is the right call for BYOD; wipe is for corporate hardware being reissued. Confirm the action completed rather than assuming it did.
14. Recover or revoke BitLocker keys
If the machine is going to somebody else, you need the recovery key. Get it out before the account object that stores it disappears. (We wrote a separate guide on exporting BitLocker recovery keys with PowerShell.)
15. Revoke Microsoft 365 licences
After the mailbox conversion, not before. This is the step that actually stops the bill.
Set-MgUserLicense -UserId $id -AddLicenses @() -RemoveLicenses $skuIds
16. Remove home folder and file share access
On-premises NTFS permissions do not care that the account is disabled. Remove the access rules and keep the folder — you may still need what is in it.
Phase 4 — Close it out
17. Move to a disabled OU and record why
A dedicated Disabled OU keeps leavers out of sync scope and group policy, and makes "who left and when" answerable at a glance. Write the leave date and reason into the account description while you are there — the person auditing this in a year will not have your ticket queue.
18. Delete on a retention policy, never on the leave date
Deleting immediately destroys mailbox and OneDrive content you might need for a legal hold, an HR matter, or a handover question three weeks later. Entra keeps a deleted user recoverable for only 30 days. Pick a retention window — 30, 60, 90 days is typical — and let a scheduled job do the deleting when the date arrives.
Why this goes wrong in practice
Not because admins do not know the list. Because offboarding happens on a bad day: somebody resigned, HR sent the ticket at 4:50pm on a Friday, and the person doing it is doing it from memory. Eighteen steps done by hand, under time pressure, occasionally — that is exactly the shape of task humans are worst at.
The fix is not a better checklist. It is not doing it by hand.
The Employee Lifecycle Toolkit
Runs the offboarding sequence from a CSV — disable, strip groups, remove file access, revoke licences, convert the mailbox to shared, and enrol the account for deletion on your retention policy. Every action logged to an audit trail, and -WhatIf shows you exactly what it would do before it does anything.
$79 one-time · perpetual licence key · built for IT admins and MSPs
See what it does →Common questions
Does disabling an account log the user out?
No. Disabling blocks new sign-ins; existing tokens stay valid until they expire. Run Revoke-MgUserSignInSession to end live sessions.
What is the single most missed step?
Revoking OAuth application consents. It is invisible in the admin centre unless you go looking, and it survives everything else on this list.
Should I delete the account straight away?
No. Delete on a retention policy. Immediate deletion destroys data you may need, and the recovery window is only 30 days.
Does any of this differ for a hybrid environment?
Yes — disable in on-premises Active Directory and let sync carry it up, rather than disabling in the cloud where the next sync can overwrite you. The order of everything else stays the same.
What about a termination for cause?
Same list, different sequence: steps 1, 2, 4 and 5 first and together, before anybody is told. Everything else can wait an hour. Sessions and app consents are what let somebody keep working after they have been walked out.