Employee offboarding in Microsoft 365, in the right order

If somebody has already left

This checklist is for doing it properly next time. When the question is whether a person who left months ago can still get in, that is former employee access, and the order of the steps changes.

The five checks, in order

Work through these before anything is removed or deleted. Each one is quick while the account still exists, and slow or impossible after it does not.

• Decide the mailbox outcome while the licence is still assigned. If the mailbox is becoming a shared mailbox, Microsoft's conversion process expects the user mailbox to still be licensed when you convert it, and after conversion an unlicensed shared mailbox is limited to 50 GB. An archive or a legal hold still needs Exchange licensing. Remove the licence first and you are recovering options instead of choosing between them.
• Preserve the OneDrive files before the account goes. A leaver's OneDrive belongs to the account, not the business. Grant a manager access or move what matters into a shared library the business owns before deletion, because once the account's retention window runs out the files are permanently deleted.
• Block sign-in, then revoke sessions. They are two separate actions. Blocking sign-in stops new sign-ins; it does not end the sessions and tokens that already exist, so revoking sessions is its own step. Even then, Microsoft notes that token and application behaviour can delay how quickly revocation takes effect, so verify by checking sign-in activity rather than assuming an instant universal logout.
• Hand over what the person owned, not just what they used. Calendars, shared mailbox access, Teams and group ownership, Power Automate flows and other automations, and every vendor or SaaS login that lives outside Microsoft 365 entirely. An automation owned by a disabled account is the classic quiet failure: nothing breaks on day one, then an invoice reminder or a report simply stops.
• Record what was done, by whom, and when. The approver, the cutoff time, and what happened to the mailbox, the files, the licences and the devices. If a dispute, an audit or an insurance question turns up months later, the evidence log is the difference between an answer and a shrug.

Why the order matters

The individual actions in an offboarding are simple. The damage comes from sequencing. Removing the licence feels like the natural first step because it is the one that saves money, and it is exactly the step that complicates the mailbox decision and puts the data on a countdown.

So the safe order is: decide and hand over first, cut access second, remove licences and delete last. If the identity source, a legal hold, privileged access or data ownership is genuinely unknown, the right move is to pause the destructive steps until someone authorized has answered, not to press on. Blocking sign-in is reversible; deletion after the retention window is not.