Employee Offboarding Process: The IT Checklist for Accounts, Devices, Data and Licenses

Updated: November 2026. Microsoft 365, Entra, Intune and Google Workspace steps, retention clocks and survey figures checked against Microsoft Learn, Google Workspace admin help, NIST and the survey publishers on 11 November 2026.

Someone hands in their notice, HR starts the paperwork, and on the last afternoon the laptop, the mailbox and the admin role are all still live. Each of them runs on its own clock, and a license removed in the wrong order can take data with it. This guide covers the IT half of the employee offboarding process: who owns each step, the order that closes access fastest, and a checklist with the Microsoft 365 and Google Workspace setting for each row.

TL;DR

• What it is. The employee offboarding process is the set of steps that removes a leaver's access, recovers devices and data, and frees licenses.
• Order. Remove admin roles, reset the password and revoke sessions first, and delete nothing yet.
• Delays. Microsoft 365 block sign-in can take up to 24 hours, so reset the password too.
• Clocks. Mail goes 30 days after license removal, and unlicensed OneDrive turns read-only at day 60.
• Automation. Entra Lifecycle Workflows run leaver tasks but need Entra ID Governance or Entra Suite.

What Is the Employee Offboarding Process?

The employee offboarding process is the set of steps an organization runs when someone leaves, from the notice to the last closed ticket. HR handles the contract, final pay and exit interview, while IT removes access, recovers devices, hands over data and frees licenses.

NIST SP 800-53 control PS-4, Personnel Termination, gives the IT half its scope. It asks you to disable access within a time you define, revoke credentials and hold an exit interview on security topics. You also retrieve security-related property such as hardware tokens, keys and badges, and keep access to the data and systems the person controlled. PS-4 leaves the time limit to your policy, so set one for resignations and one for dismissals.

Who Owns Each Offboarding Step

Offboarding breaks at the handoffs, so give each part an owner before the next resignation lands.

The Offboarding Request IT Needs From HR

An employee offboarding form starts the IT work, and its ticket ID is the first proof. Ask HR for these fields:

• Legal name and user principal name (UPN)
• Last day and hour, with time zone
• Voluntary or involuntary exit
• Manager, and who inherits mail and files
• Devices issued, from the asset record
• Admin roles and legal hold, yes or no

The Employee Offboarding Workflow, Step by Step

The workflow runs in six stages, from the notice to day 93.

Each stage leaves the next one a clean state. Sign-in goes at the exit hour, but licenses come off only after mail and files have a new owner, because that's when the deletion clocks start.

Voluntary vs Involuntary Exits

The steps stay the same, and the timing moves.

The IT Offboarding Checklist

Here's the checklist as an employee offboarding template. Copy the rows into your ticket template and attach the proof as you go.

Accounts and Sessions

Order matters, because each control closes a different door. Microsoft's steps start with a password reset, then Sign out of all sessions. Block sign-in alone can take up to 24 hours to apply, while the reset works at once. Microsoft 365 asks the user to sign in again within an hour, the default life of an Entra access token.

In the Entra admin center, clear Account enabled, then select Revoke sessions. In Graph PowerShell, that's Update-MgUser -AccountEnabled:$false and Revoke-MgUserSignInSession. Require re-register MFA deletes phone, Authenticator and software OATH registrations, and an Authentication Administrator can delete app passwords too. Entra can't revoke a session token an app issued itself, so those apps need their own sign-out.

For a hybrid account, also run Disable-ADAccount on-premises, and reset the password twice if it may be compromised, to blunt pass-the-hash. Our Entra ID vs AD comparison explains where each account lives.

In Google Workspace, suspending a user resets their sign-in cookies, which signs them out of browsers and mobile. Resetting cookies doesn't reach desktop apps such as Drive for desktop, and managed computers have a separate Sign Out User action.

Devices and Hardware Recovery

Device recovery starts with ownership: wipe a company laptop, retire a personal phone.

Before you retire or delete a BitLocker-protected, Entra-joined Windows device, back up its recovery key and local admin credentials, because Intune removes the key protectors. Our BitLocker recovery key guide shows where keys live.

Personal devices need the retire rule agreed before anyone leaves, and our BYOD policy template has the clause.

When a wiped device leaves the company for good, delete it from Intune, then deregister it from Windows Autopilot where it applies. Microsoft advises against deleting an Autopilot device's Entra record by hand, so remove that record only for devices outside Autopilot. Keep the registration for a laptop you'll reissue, and re-enable its Entra device record if you disabled it at the exit hour.

Hardware collection is the step that slips, so mark the asset pending return the day the request lands. Devices you won't reissue move to the asset retirement stage.

Mailbox, Files and Data

Decide who inherits the mail before you touch the license. A user mailbox needs a license to convert to a shared mailbox, and the license can come off afterwards. An unlicensed shared mailbox holds 50 GB, and a hold on it needs Exchange Online Plan 2, or Plan 1 plus Exchange Online Archiving.

Keep the old user account, because it anchors the shared mailbox. Keep its sign-in blocked and reset the password, or the leaver's credentials still open it. Inbox rules survive the conversion, so check for forwarding. Copies beyond what holds keep are a backup question, covered in email archiving vs backup.

For files, open the user in the Microsoft 365 admin center, then OneDrive > Get access to files > Create link to files. In Google Workspace, transfer the Drive files the person owns before deletion. Shared drive files belong to the organization, so they need no transfer.

Two employee offboarding email templates cover the mail side, an auto-reply and a note to the manager:

text
[Name] no longer works at [Company]. For [topic], please contact [Manager] at [email].

text
Subject: Handover for [Name]
You can now open [Name]'s mailbox and OneDrive. Move what you need to SharePoint by [day 60 date], when the files turn read-only.

Licenses and SaaS Seats

Remove licenses last. On a Google Workspace Annual or Fixed-Term plan, deleting a user doesn't reduce the license count, so reassign the seat. Our software license audit guide covers reclaiming seats.

Apps outside SSO need their owner, because Microsoft says to build a separate process for apps without automatic deprovisioning. They can surface as shadow IT during an exit.

What Expires After You Remove an Account

Every removal starts a clock, and the clocks don't line up. These are the documented ones, read on 11 November 2026.

The 365-day OneDrive clock started on 1 July 2026, and accounts already unpaid then are at risk no earlier than 1 July 2027. Without unlicensed-account billing, retention policies and holds don't stop that deletion. Assigning a license again brings an archived account back within 24-48 hours at no fee.

Google has its own trap. A suspended account bills like an active one, and deleting a user deletes what Vault holds for them. The Archived User license keeps Vault retention and holds in place.

In June 2026, a new admin at a nonprofit with under 50 staff asked r/sysadmin about more than 500 accounts. Nearly all belonged to former employees, blocked and unlicensed but kept for legal reasons. The top reply says unlicensed data is already partly gone. Other replies suggest deciding at the exit: convert mail to shared, move OneDrive files to SharePoint and use holds only where the data is required.

Employee Offboarding Security

Access that outlives the job is the security side of offboarding. Tailscale's State of Zero Trust 2025 surveyed 1,000 IT, security and engineering professionals in the US and Canada. Of those, 68% said they kept access to a former employer's systems after leaving, and 6% kept it a year or longer. Tailscale calls itself "not a neutral observer", so read it as a vendor survey. BetterCloud's 2026 State of SaaS report, also a vendor survey, found 18% of enterprises had a data breach through an un-offboarded ex-user in the past 12 months.

The side doors are shared passwords, MFA methods, app passwords, forwarding rules, delegated mailbox access and admin roles in apps outside SSO. Remove admin roles first, since they reach everything else, and our guide to privileged access management covers them.

Shared logins are easier to rotate when they live in a vault, because you can see what a leaver could open. Our password manager for MSPs comparison covers the options.

Security's day-2 and day-30 review checks sign-ins on the disabled account and new forwarding rules. Leavers are one of the risks in our guide to insider threats.

Can You Automate Employee Offboarding?

Yes, in part, with the HR system as the trigger. Microsoft Entra Lifecycle Workflows run leaver tasks from a user's employeeLeaveDateTime attribute, and they need Microsoft Entra ID Governance or Microsoft Entra Suite licenses. Built-in tasks disable the account, revoke refresh tokens, remove licenses, groups and Teams, delete the user and email the manager. Entra Entitlement Management can also open a ServiceNow ticket for apps that need manual deprovisioning.

Watch the order. A workflow that strips licenses on the last day leaves the mailbox needing one again before it can convert to shared. Hardware, apps without automatic deprovisioning, shared secrets, holds and the handover still need a person. BetterCloud's 2026 report puts offboarding automation at 27% of organizations, against 37% for onboarding.

Microsoft Mechanics walked through HR-driven leaver workflows in Entra in July 2023. The idea holds, though the admin center menus have moved and licensing is now Entra ID Governance or Entra Suite.

An r/sysadmin thread from April 2026 asks how teams track terminated users beyond Excel sheets. Replies describe HR-triggered scripts that use Graph and Exchange Online PowerShell to disable the user, revoke sessions and set an out-of-office. One fallback is a monthly leaver report from HR.

Offboarding Tools by Category

Employee offboarding software falls into five categories, each covering part of the checklist.

Our guide to access request management covers the governance category. AI agents can work the ticket and the checklist too, with a technician approving each wipe or deletion.

OpenFrame is open, AI-native infrastructure for IT and security, where Mingo runs IT operations and Fae resolves support requests, so the offboarding ticket, device record and checklist sit in one place. It isn't an identity provider, so account changes stay in Entra or Google Workspace. It costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, so read this mention with that in mind.

A Worked Example

Take a made-up resignation: an account manager on Microsoft 365 and Intune, with a company laptop, a personal phone and a last day of Friday at 17:00.

Remote Staff and MSP-Managed Clients

Remote exits add shipping to the hardware step, and an offline laptop keeps its data until it connects. Our guide to remote worker IT support has the remote steps.

For an MSP, take the request only from the client's named approver, and call back on anything else. When the client itself leaves, use our client offboarding checklist instead.

Employee Offboarding in Short

The employee offboarding process is a handoff between HR and IT with a fixed order: request, legal hold, admin roles, sign-in, mail and files, devices, then licenses. Block sign-in can lag by up to 24 hours, so reset the password and revoke sessions at the exit hour. Licenses come off last, because the 30-day mail clock and the day-60 OneDrive clock start then. Next, turn this checklist into a written runbook with our guide to standard operating procedures.