IT Offboarding: Checklist for Departing Employees

The BSI IT-Grundschutz Compendium (2023 edition) covers departures in basic requirement ORP.2.A2 “Regulated procedure when employees leave.” Supervisors and IT operations are responsible. Among other things, it requires:

• Successors are briefed in good time. If a direct handover is not possible, the departing employees document their tasks in detail.
• All documents, keys, and devices received in the course of the work, as well as ID badges and access authorizations, are collected.
• Before they leave, departing employees are reminded once more of their confidentiality obligations.
• Emergency plans and other procedures are updated, and all affected units, such as the IT department or security staff, are informed.
• There should be a checklist for the tasks involved, and a designated contact person in the HR department should accompany the departure.

For accounts and permissions, ORP.4.A2 applies: when personnel change, user IDs and permissions that are no longer needed must be removed. Under ORP.4.A3, the existing IDs, groups, and permission profiles are documented. This documentation is the basis for not overlooking anything during a departure.

The order and phases in this document are a TOMORIS recommendation. Your own policies and contracts are binding; the retention periods in Microsoft 365 come from Microsoft's documentation (for the date, see Sources).

• A successor or deputy is named and briefed; where no direct handover is possible, the tasks are documented (ORP.2.A2, ORP.2.A3).
• All of the person's accounts are recorded: Microsoft 365 and Entra ID, local sign-in, business applications, VPN, cloud services, and supplier portals (based on the documentation under ORP.4.A3).
• Elevated permissions are known: administrative roles, permissions on other people's mailboxes, and ownership of Teams, groups, and SharePoint sites.
• Shared credentials known to the person are listed so they can be changed after the departure.
• Business data is stored in the designated shared storage and not only locally or in the personal OneDrive.
• A decision has been made for the mailbox: conversion to a shared mailbox or forwarding to a colleague.
• It is defined who takes over the OneDrive content. The person's manager is entered in Microsoft Entra ID; by default, the manager gets access when the account is deleted.
• Issued devices, security keys, keys, ID badges, and access media are on a list to check off.
• Emergency plans, contact lists, and on-call schedules are updated (ORP.2.A2).
• Affected units such as IT, reception, facility management, and external service providers know the departure date (ORP.2.A2).

1. 1

   Reset the password and sign out

   In the Microsoft 365 admin center, reset the password and sign the person out of all sessions. According to Microsoft, resetting the password prevents sign-in immediately, whereas blocking sign-in can take up to 24 hours. An access token remains valid for up to one hour.

2. 2

   Block sign-in and revoke sessions

   Block sign-in, which means turning off “Account enabled” in the Microsoft Entra admin center, and then select “Revoke sessions.” The person then no longer receives new tokens for any application connected to Entra ID.

3. 3

   Don't forget on-premises Active Directory

   If accounts are synchronized from an on-premises Active Directory, disable the account there as well and reset the password. Microsoft recommends resetting it twice to reduce the risk of pass-the-hash attacks; if the account is definitely not compromised, once is enough.

4. 4

   Wipe and block mobile devices

   For smartphones used for work, remotely wipe the company data and block access in the Exchange admin center, or via Intune if they are managed with Intune. A wipe only takes effect when the device is online; while offline, locally stored data remains accessible.

5. 5

   Collect devices, keys, and ID badges

   Take back the notebook, smartphone, security keys, keys, ID badges, and access authorizations, and check them off on the list (ORP.2.A2). Block access authorizations in the locking or access control system.

6. 6

   Applications outside Entra ID

   Block applications with their own sign-in or their own sessions individually. Microsoft points out that Entra ID cannot revoke session tokens issued by applications; automatic deprovisioning closes this gap where the application supports it.

7. 7

   Change shared credentials

   Change the passwords of shared accounts and access credentials that the person knew. The list from the preparation serves as a template.

Before saying goodbye, remind the person once more of existing confidentiality obligations (ORP.2.A2).

• Mailbox converted to a shared mailbox, with forwarding if needed, before the license is removed.
• The person's meetings canceled so that attendees can remove them and booked rooms and equipment become available again.
• OneDrive content reviewed and taken over by the responsible person.
• License removed or assigned to another person.
• Permissions on shared resources removed: groups, Teams, SharePoint sites, permissions on other people's mailboxes (ORP.4.A2).
• Account deleted as soon as it is no longer needed for the mailbox or forwarding; delete synchronized accounts in on-premises Active Directory, not in Microsoft 365.
• Documentation of IDs and permission profiles updated (ORP.4.A3).

If employment ends at short notice or misuse of credentials is a concern, we recommend blocking access at the same time as the conversation and organizing the handover afterward. Microsoft explicitly names termination of employment as a reason to revoke all access and recommends blocking sign-in if an account is suspected of being compromised.

• Disable the account in Microsoft Entra ID and revoke sessions; if synchronized, also disable it in on-premises Active Directory and reset the password twice.
• Disable the person's devices registered in Entra ID.
• Block remote access such as VPN and applications with their own sign-in individually.
• Wipe and block mobile devices with company data.
• Change the credentials of shared accounts.

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
$User = Get-MgUser -Search UserPrincipalName:'name@firma.at' -ConsistencyLevel eventual
Update-MgUser -UserId $User.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $User.Id
Get-MgUserRegisteredDevice -UserId $User.Id -All | ForEach-Object {
    Update-MgDevice -DeviceId $_.Id -AccountEnabled:$false
}

For each departure, record who completed which item and when. This lets you prove later that access was revoked in time.