Microsoft 365 offboarding: secure access and preserve business records in the right order

Start with an authorized trigger and a precise time

A reliable offboarding process begins with an approved request from the accountable business or HR owner. Record the identity, effective time, manager, employment status, device ownership, special legal instructions, and people responsible for each action. Urgent termination and planned departure can use the same checklist with different timing.

At the effective time, prevent sign-in, reset credentials as appropriate, revoke active sessions, and remove privileged role eligibility or assignments. Review authentication methods, application passwords, registered devices, delegated access, enterprise applications, API credentials, and shared secrets owned by the person. If the identity is synchronized from on-premises Active Directory, make the authoritative lifecycle change in the source directory; Microsoft notes that deletion and restoration cannot be managed only in Microsoft 365 in that model.

Protect devices and preserve evidence

Decide whether each device is company-owned or personal before issuing retire, wipe, or lock actions. A full wipe and a selective organizational-data removal have materially different consequences, and support varies by enrollment platform. Preserve security evidence needed for an investigation before destructive actions.

Records disposition must precede license removal and account deletion. Determine whether legal hold, retention, eDiscovery, regulatory, contractual, or litigation requirements apply. Those capabilities and retention results depend on licensing and configuration. Obtain legal or records-management direction when required; an IT convenience decision is not a substitute.

1. Preserve or transfer required mailbox data. Decide whether to convert the mailbox, delegate access, or configure forwarding based on an approved business need.
2. Grant an accountable successor access to required OneDrive content and transfer ownership of business files, sites, Teams, groups, shared mailboxes, applications, automations, and service documentation.
3. Remove the user from groups, Teams, distribution lists, shared resources, partner portals, line-of-business systems, VPN, physical access, and vendor services.
4. Communicate the replacement contact without exposing private employment information.
5. Remove or reassign licenses only after dependent data and service behavior are confirmed.
6. Delete the account only when the approved retention and continuity plan permits it.

Treat retention windows as constraints, not backups

Microsoft’s current offboarding guidance describes common 30-day retention and restoration windows for deleted user mailbox and OneDrive content, with different behavior when a license is removed but the account remains. Holds, tenant settings, subscription changes, and future product changes can alter outcomes. Verify the current Microsoft documentation and the tenant’s actual configuration before deletion. A published retention window should not be the only copy of business-critical information.

Close with evidence and a follow-up

Record timestamps, successful session revocation, data custodians, forwarding expiration, license changes, device actions, exceptions, and the final account state. Schedule a follow-up to remove temporary forwarding or delegated access and confirm that no critical workflow depended on the departed identity. Offboarding is complete when access is closed, necessary records are controlled, business ownership is transferred, and temporary measures have an end date.