TOOLBOX · DOWNLOAD
IT offboarding with no open access.
When employees leave the company, accounts, shares, and devices often remain that nobody keeps track of anymore. This checklist organizes the departure into three phases: before the last working day, on the last day, and afterward. It is based on requirements ORP.2.A2 and ORP.4.A2 of the BSI IT-Grundschutz Compendium. For Microsoft 365, it lists the steps and retention periods from Microsoft's documentation, so that no access remains open and no data is lost.
Free PDF · Checklist
IT Offboarding: Checklist for Departing Employees
- Format
- PDF, A4
- Length
- 8 pages
- Size
- 117 KB
- Updated
- Oct 25, 2026
- Sources
- 11
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Close out accounts, devices, data, and permissions in an orderly way, based on BSI IT-Grundschutz and with the steps for Microsoft 365.
- HR and people managers who support departures
- IT management and administrators of Microsoft 365 and Microsoft Entra ID
- Managers who organize handover, succession, and deputies
7 SECTIONS
What Is
Inside.
- 01
What Must Be Defined for a Departure
The requirements of the BSI IT-Grundschutz Compendium for departing employees and for permissions.
- 02
The Process at a Glance
Three phases from learning of the departure to deleting the account.
- 03
Before the Last Working Day
Handover, deputies, and a complete list of all access before time pressure sets in.
- 04
On the Last Working Day: End Access
Reset the password, block sign-in, revoke sessions, and collect devices and access media.
- 05
After the Departure: Mailbox, OneDrive, and License
What Microsoft 365 does with the mailbox, OneDrive, and account, and which retention periods apply.
- 06
Special Case: Departure with Immediate Effect
For short-notice separations or suspected misuse, block first, then hand over.
- 07
Who Does What
Tasks of HR, supervisors, IT operations, and facility management during a departure.
EXCERPT
On the Last Working Day: End Access
Reset the password and sign out
In the Microsoft 365 admin center, reset the password and sign the person out of all sessions. According to Microsoft, resetting the password prevents sign-in immediately, whereas blocking sign-in can take up to 24 hours. An access token remains valid for up to one hour.
Block sign-in and revoke sessions
Block sign-in, which means turning off “Account enabled” in the Microsoft Entra admin center, and then select “Revoke sessions.” The person then no longer receives new tokens for any application connected to Entra ID.
Don't forget on-premises Active Directory
If accounts are synchronized from an on-premises Active Directory, disable the account there as well and reset the password. Microsoft recommends resetting it twice to reduce the risk of pass-the-hash attacks; if the account is definitely not compromised, once is enough.
Wipe and block mobile devices
For smartphones used for work, remotely wipe the company data and block access in the Exchange admin center, or via Intune if they are managed with Intune. A wipe only takes effect when the device is online; while offline, locally stored data remains accessible.
Collect devices, keys, and ID badges
Take back the notebook, smartphone, security keys, keys, ID badges, and access authorizations, and check them off on the list (ORP.2.A2). Block access authorizations in the locking or access control system.
Applications outside Entra ID
Block applications with their own sign-in or their own sessions individually. Microsoft points out that Entra ID cannot revoke session tokens issued by applications; automatic deprovisioning closes this gap where the application supports it.
Change shared credentials
Change the passwords of shared accounts and access credentials that the person knew. The list from the preparation serves as a template.
Before saying goodbye, remind the person once more of existing confidentiality obligations (ORP.2.A2).
SOURCES
Supported
by Sources.
- BSI IT-Grundschutz Compendium, module ORP.2 Personnel (2023 edition) (opens in a new tab)ORP.2.A2 Regulated procedure when employees leave, ORP.2.A3 Deputy arrangements, accessed October 25, 2026
- BSI IT-Grundschutz Compendium, module ORP.4 Identity and Access Management (2023 edition) (opens in a new tab)ORP.4.A2 Revoking permissions, ORP.4.A3 Documentation of IDs and permission profiles
- Microsoft Learn: Remove a former employee and secure data (overview) (opens in a new tab)Steps 1 to 7, retention of the mailbox and OneDrive after license removal and deletion
- Microsoft Learn: Step 1, Prevent sign-in and block access to Microsoft 365 (opens in a new tab)Reset the password, sign out of all sessions, block takes up to 24 hours
- Microsoft Learn: Step 3, Wipe and block a former employee's mobile device (opens in a new tab)
- Microsoft Learn: Step 4, Forward email or convert to a shared mailbox (opens in a new tab)50 GB limit, account remains in place, cancel meetings
- Microsoft Learn: Revoke user access in Microsoft Entra ID (opens in a new tab)Token lifetime, session tokens, reset Active Directory twice, disable devices, wipe only online
- Microsoft Learn: OneDrive retention and deletion (opens in a new tab)Manager access, 30-day retention, 93-day recycle bin, archive from day 93 without a license
- Microsoft Learn: Manage unlicensed OneDrive user accounts (opens in a new tab)Read-only from day 60, archive from day 93, deletion risk after 365 unpaid days
- Microsoft Learn: No soft-deleted mailbox after removing the license (opens in a new tab)Mailbox is disconnected immediately and deleted after 30 days
- Microsoft Learn: Restore or remove a recently deleted user (opens in a new tab)Recoverable for 30 days
This checklist is a TOMORIS recommendation and does not replace advice on employment or data protection law. Names, steps, and retention periods in Microsoft 365 may change; Microsoft's current documentation is authoritative.
TOOLBOX
Explore
Further.
IT Onboarding and Offboarding
All IT steps when employees join and leave, briefly explained.
Learn MoreLeast Privilege
The principle of least privilege: only the permissions a task really needs.
Learn MoreMicrosoft Entra ID
Microsoft's service for identities and access: users, sign-ins, applications, and policies.
Learn MoreIT Asset Management
Record and manage hardware, software, licenses, and cloud subscriptions across the entire lifecycle.
Learn More
IT OPERATIONS & ORGANIZATION
More on
This Topic.
- PDF
IT Onboarding Checklist
Account, permissions, device, secure first sign-in, data secrecy and initial training: joining step by step, based on BSI IT-Grundschutz and the DSG (Austrian Data Protection Act), with the steps for Microsoft 365.
View - PDF
IT Inventory Template
Fields for processes, data, endpoints, servers, software, cloud services, and service providers, each with an example column, plus protection requirements, lifecycle, and review intervals, backed by CIS, NIST, and BSI.
View - PDF
IT Operations Manual
Outline with tables to fill in: system overview, roles and access without passwords, recurring procedures, change log, contracts and emergency section, based on BSI IT-Grundschutz.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.