Microsoft 365 Offboarding Checklist
A Microsoft 365 offboarding checklist: block sign-in, revoke sessions, convert the mailbox to shared, hand over OneDrive and Teams, and remove the licence.
- Typical schedule per leaver
- The checklist 4 sections, 20 items
- Variables
{{employee_name}}{{user_upn}}{{new_owner}} - Start from CI
Use this checklist when someone leaves and your company runs on Microsoft 365: Exchange Online, OneDrive, SharePoint and Teams, with Entra ID as the directory. It covers what to do in the Microsoft admin centers. Run your general IT offboarding checklist alongside it for non-Microsoft systems and devices.
Who owns it
A user administrator or global administrator owns the run. The leaver's manager decides who takes over the mailbox, OneDrive files and Teams ownership. Microsoft renames menus regularly, so read the items as outcomes, not exact click paths.
Common pitfalls
- Removing the licence first. If you remove the licence before you deal with the mailbox, the mailbox enters a grace period and is later deleted. Convert it to a shared mailbox first, then remove the licence.
- Blocking sign-in without revoking sessions. Existing tokens can keep working for a while. Revoke sessions in Entra ID as well.
- OneDrive disappears after deletion. A deleted user's OneDrive is kept only for the retention period configured in SharePoint. Move what matters before you delete the account.
- Teams with a single owner. If the leaver was the only owner of a team, nobody can manage it. Add a new owner before the account goes.
- Shared mailbox limits. A shared mailbox without a licence has size limits, and features such as an archive or a litigation hold need a licence. Check before you assume it is free.
When the run starts from your HR system, the Microsoft steps never wait on an email, and each step is recorded with a name and a time.
The checklist: Microsoft 365 offboarding: {{employee_name}}
Block access
-
Cut-off time and new owner
{{new_owner}}confirmed with the leaver's manager -
Sign-in blocked for
{{user_upn}}in the Microsoft 365 or Entra admin center -
All sessions revoked for the user in Entra ID
This invalidates refresh tokens, so Outlook, Teams and mobile apps have to sign in again and fail.
-
Password reset to a random value
-
Authentication methods removed (authenticator app, phone, security keys)
-
Company data wiped or devices retired in Intune or your MDM optional
-
Removed from privileged roles, security groups and distribution lists
Mailbox
-
Mailbox converted to a shared mailbox
Do this before removing the licence. Check the size limit and whether an archive or hold needs a licence.
-
{{new_owner}}given Full Access to the shared mailbox optional -
Automatic reply set to point senders to the right contact optional
-
Mail forwarding to
{{new_owner}}configured if agreed optional -
Litigation hold or retention policy applied if your policy requires it optional
Files and Teams
-
OneDrive content moved to a SharePoint site or shared with
{{new_owner}} -
Ownership of Teams, SharePoint sites and Microsoft 365 groups transferred
-
Planner plans, Power Automate flows and Forms owned by the user reassigned optional
Flows owned by a deleted user can stop running. Check them before deletion.
-
Shared calendar meetings organised by the user replaced or handed over
Close out
-
Licences removed and reassigned or reduced in billing
-
Account deletion date set according to the retention policy
-
OneDrive retention period in SharePoint checked against that date
-
Manager told where the mailbox and files are now
Checklist as Markdown
Start this checklist from your pipeline
When HR records a leaver, POST /api/v1/runs with template "Microsoft 365 offboarding: {{employee_name}}" and user_upn and new_owner.
curl -X POST https://runbook.metastic.ch/api/v1/runs \
-H "Authorization: Bearer $RUNBOOK_TOKEN" \
-H "Content-Type: application/json" \
-d '{"template": "Microsoft 365 offboarding: {{employee_name}}", "variables": {"employee_name": "…", "user_upn": "…", "new_owner": "…"}}'Frequently asked questions
How do I convert a leaver's mailbox to a shared mailbox in Microsoft 365?
In the Microsoft 365 admin center, open the user, go to the mail settings and choose to convert to a shared mailbox. You can also do it in the Exchange admin center or with PowerShell. Grant colleagues access, and only then remove the licence. A shared mailbox without a licence has a size limit, so check the mailbox size first.
Does blocking sign-in in Microsoft 365 log the user out immediately?
Not always. Blocking sign-in stops new logins, but existing sessions can last until their tokens expire. Revoke sessions for the user in Entra ID at the same time to force every app to sign in again.
What happens to OneDrive when a Microsoft 365 user is deleted?
The OneDrive is kept for the retention period set in the SharePoint admin center and then deleted. By default, the user's manager is given access during that time, and you can also name a secondary owner in SharePoint settings. Move important files to a SharePoint site or a colleague before the period ends. Adapt retention to your jurisdiction and internal policy.
Updated