The Employee Offboarding Security Checklist

When an employee leaves a business, leadership attention naturally centres on commercial handovers, reallocating client accounts, and conducting exit interviews. Yet from an IT security perspective, an offboarding event represents one of the most volatile and high-risk periods in an organisation's operational lifecycle.

Industry research shows that over 45% of employees admit to taking company confidential documents, client contact databases, proposal templates, or code repositories when departing for a competitor. Furthermore, unrevoked accounts leave dormant "ghost credentials" that cybercriminals actively scan for to breach corporate networks months after an employee has moved on.

Below is the precise, step-by-step technical offboarding checklist I deploy for clients across Microsoft 365 and hybrid cloud networks to ensure complete intellectual property protection and zero compliance exposure.

Phase 1: Immediate Identity & Access Termination

Timing is everything. Technical access revocation should coordinate with the HR departure conversation. Do not wait until the end of the day or over the weekend.

1. Invalidate Active Token Sessions & Block Sign-In

In modern cloud identity systems like Microsoft Entra ID (Azure AD), simply changing an account password does not immediately disconnect active user sessions on laptops, tablets, or phones. Modern OAuth authentication tokens can persist for up to 24 hours.

• Revoke All Active Sessions: Navigate to the user profile in Entra ID Admin Center and click "Revoke Sessions". This instantly terminates all active Microsoft 365 tokens across web browsers, Outlook, Teams, and mobile apps worldwide.
• Block Sign-In: Toggle the user status to "Block Sign-in" immediately. This prevents the user from initiating any new authentication requests.

2. Reset Credentials & Invalidate MFA Methods

Generate a randomized 24-character password for the account and remove all registered Multi-Factor Authentication (MFA) methods (such as the Microsoft Authenticator app on the employee's personal phone, FIDO2 security keys, and phone numbers). This guarantees the former employee cannot trigger a self-service password reset or approve push notifications.

Phase 2: Data Preservation & Licence Rationalisation

A common mistake made by small businesses is immediately deleting the departing employee's account. Doing so initiates a 30-day permanent deletion countdown on their mailbox, OneDrive documents, and Teams chats. Once that countdown finishes, business-critical correspondence and contracts are irrecoverable.

3. Convert Mailbox to a Free Shared Mailbox

Microsoft 365 allows you to convert any standard Exchange Online user mailbox into a Shared Mailbox at zero ongoing cost (for mailboxes under 50GB):

1. Convert the mailbox to a Shared Mailbox via the Exchange Admin Center.
2. Delegate "Read and Manage" and "Send As" permissions to the departing employee's line manager or designated team member.
3. Set up an automated Out of Office response advising senders of the staff member's departure and providing the new point of contact.
4. Strip the paid licence: Once converted to a shared mailbox, you can safely remove the paid Microsoft 365 license (saving £10 to £19/month per departed user) while preserving every historical email indefinitely.

4. Reassign OneDrive & SharePoint Storage

By default, Microsoft 365 retains a deleted or unlicensed user's OneDrive files for 30 days before permanent purging. As an administrator:

• Grant manager access to the former employee's OneDrive URL via the M365 Admin Center.
• Transfer critical working documents into permanent company SharePoint document libraries.
• If long-term archival is required, apply an explicit Microsoft Purview Retention Policy to lock the files in an immutable state for compliance and legal review.

"Hope is not a security strategy. Offboarding must be an instantaneous, documented, and automated technical process rather than an afterthought."

Phase 3: Endpoint Governance & Remote Device Wipe

Whether staff used company-issued hardware or personal devices, your company data must be physically expunged from the hardware.

5. Corporate Laptops: Full Remote Wipe via Microsoft Intune

If the employee was allocated a company-owned Windows 11 or macOS laptop:

• If the physical machine is returned to the office, execute an Autopilot Reset or Fresh Start via Microsoft Intune. This purges all local user profiles, cached credentials, and temp files, restoring the operating system to a pristine, encrypted factory baseline ready for the next recruit.
• If the departure is hostile or the employee is remote and uncooperative, issue an immediate Remote Wipe command from Intune. The next time the laptop connects to Wi-Fi, it will wipe its drive and lock itself down completely.

6. Personal Devices (BYOD): Selective App Wipe

If the employee accessed work email or Teams from a personal smartphone, executing a full device wipe is legally problematic because it would destroy their personal photos and messages. Through Intune App Protection Policies (MAM), I run a Selective Wipe. This removes only corporate emails, files, and Teams history while leaving the employee's personal device untouched.

Phase 4: Third-Party SaaS & Perimeter Auditing

Microsoft 365 is your central identity hub, but what about external services?

• Single Sign-On (SSO) Auditing: If you use Entra ID SSO for third-party platforms (such as Xero, HubSpot, or Figma), blocking the primary Microsoft account automatically severs access to those platforms instantly.
• Standalone Accounts: For legacy services not connected to SSO, manually rotate passwords and revoke administrative access for company social media accounts (LinkedIn, Meta Business Suite), Google Analytics, domain registrars, hosting portals, and code repositories (GitHub).
• Password Managers: If your company uses 1Password or Bitwarden, revoke the employee's account from the organisation's vault to prevent local caching of company credentials.

Summary: The 60-Second Offboarding Checklist

• ✓ Invalidate active browser and app sessions in Entra ID.
• ✓ Set user to "Block Sign-in" and randomize password.
• ✓ Wipe registered MFA devices and phone numbers.
• ✓ Convert user mailbox to Shared Mailbox and delegate access.
• ✓ Transfer OneDrive files to SharePoint library.
• ✓ Reclaim paid Microsoft 365 license.
• ✓ Execute Intune device wipe (full for company laptops, selective for BYOD).
• ✓ Revoke standalone SaaS, social media, and vault credentials.