.png)
Why offboarding is a security event
Most organizations treat employee offboarding as an HR process. IT is an afterthought — accounts get disabled days later, if at all. This gap is where breaches happen. A departing employee with active credentials has full access to email, files, CRM data, and cloud applications until someone remembers to pull the plug.
The Ponemon Institute found that 62% of employees admit to taking company data when they leave. Verizon's Data Breach Investigations Report consistently lists insider threats — both malicious and accidental — among the top breach causes. The window between an employee's last day and account termination is the highest-risk period in the entire employment lifecycle.
Figure 1 — IT offboarding timeline. The high-risk window is the period between notice and account termination. Every hour of active access after an employee's last day is unnecessary exposure.
The complete IT offboarding checklist
Identity and access — immediate
| Action | Tool | Notes |
|---|---|---|
| Disable Entra ID (Azure AD) account | Microsoft Entra admin center | Blocks all M365 and Entra-integrated app access immediately |
| Revoke all active sessions and tokens | Entra ID — Revoke Sessions | Terminates active browser sessions and cached tokens |
| Remove all MFA methods | Entra ID — Authentication methods | Prevents account recovery via registered phone/authenticator |
| Disable on-premises AD account | Active Directory Users and Computers | Required if hybrid environment; Entra disable alone is not sufficient |
| Remove from all security and distribution groups | Entra ID / AD | Eliminates residual access granted via group membership |
| Terminate VPN and remote access | Firewall / VPN console | Separate from M365 — must be revoked independently |
| Change all shared/service account passwords the employee knew | Password manager audit | Any shared credential the employee had access to must be rotated |
Devices and data
| Action | Tool | Notes |
|---|---|---|
| Retrieve all company-owned devices | Asset inventory | Laptops, phones, tablets, access cards, keys |
| Remote wipe unrecovered devices | Microsoft Intune | Selective wipe removes corporate data; full wipe for company-owned devices |
| Place mailbox on litigation hold | Microsoft Purview | Preserves all email for legal and compliance purposes before disabling |
| Convert mailbox to shared mailbox | Exchange admin center | Preserves email access for manager; releases the M365 license |
| Set up email auto-reply and forwarding | Exchange admin center | Forward to manager for 30–90 days; set out-of-office message |
| Transfer OneDrive file ownership | SharePoint admin center | Assign to manager; OneDrive is preserved for 30 days by default then deleted |
| Audit and transfer Teams ownership | Teams admin center | Employee may be the sole owner of critical Teams channels |
Third-party applications
This is the most commonly missed step. Employees accumulate OAuth app permissions and SaaS accounts that are invisible to IT unless actively audited:
- Audit OAuth permissions: In Entra ID, review all apps the user granted permissions to. Revoke any that should not persist.
- SaaS applications: CRM (Salesforce, HubSpot), project management (Asana, Monday), HR systems, billing platforms. Each requires a separate deprovisioning step.
- GitHub / code repositories: Remove from organization and revoke personal access tokens.
- Cloud infrastructure: AWS, Azure, GCP — remove IAM users and access keys immediately.
Privileged accounts require extra steps
For employees with administrative access — IT staff, system administrators, finance managers with elevated ERP access — the offboarding process requires additional steps:
- Audit all privileged role assignments in Entra ID (Global Admin, Exchange Admin, etc.) and remove before disabling the account.
- Rotate any service account passwords or API keys the employee managed.
- Review recent privileged activity in the SIEM for anomalies in the 30 days before departure.
- Conduct an exit interview with IT to document all systems the employee had access to.
See our Microsoft 365 Security Baseline for the full identity governance configuration, and our Wire Fraud & BEC Prevention article for the insider threat scenarios that offboarding gaps enable.
Contact our engineers to build a standardized offboarding runbook for your organization and integrate it with your HR workflow.
