The Employee Offboarding Checklist: Close Every IT Door

Late August has a rhythm every Quebec business knows. Summer students hand in their last timesheet, interns present their final project, and a few permanent employees time their resignation for the return from vacation. Each of those departures leaves behind an account, a mailbox, a laptop and a trail of app permissions. Without an employee offboarding checklist, your IT team improvises, and improvised offboarding is how former staff end up still reading company email in October.

We already published the mirror image of this process, an employee onboarding checklist, and readers kept asking for the departure version. Here it is: a numbered offboarding checklist for Microsoft 365 environments, organized by what must happen in the first hour, the first day and the first week. It also covers the part most guides skip: what Quebec's Law 25 requires you to keep, what it requires you to delete, and how backup retention bridges the two.

Key Takeaways

• Disable the Entra ID account and revoke sessions within the first hour, not the first week.
• Convert the mailbox to a shared mailbox to keep history without paying for a licence.
• Wipe corporate devices, retire personal ones. Intune handles both remotely.
• Law 25 requires destroying personal data once its purpose is fulfilled, so document your retention schedule.
• Dropsuite keeps departed-user mailboxes restorable long after the licence is reclaimed.

Why Departures Fail More Often Than Arrivals

Onboarding polices itself. If the new hire can't log in on day one, someone calls within the hour. Offboarding has no such alarm. The person leaves, nothing visibly breaks, and the account sits there, active, licensed and forgotten. Based on field observations from tenant audits, it's common to find sign-in-enabled accounts belonging to people who left months earlier, sometimes with mail forwarding still pointed at a personal address.

The risks stack up quietly. A dormant account is a phishing target nobody monitors. An unreclaimed licence costs money every month. And an ex-employee with working credentials is a data incident waiting for a motive. That's why our managed IT clients run offboarding from a ticket template with named owners and due dates, the same way they run onboarding. The checklist below is that template.

The Employee Offboarding Checklist: The First Hour

The clock starts when HR confirms the departure. For a friendly exit, the first hour means the hour after the goodbye handshake. For a termination, it means the hour before the meeting ends.

1. Disable the account in Entra ID. Open the user in the Entra admin centre and block sign-in. This stops new logins across Microsoft 365, the VPN and every app behind single sign-on.
2. Revoke sessions and app tokens. Blocking sign-in doesn't close sessions that are already open, and access tokens can stay valid for up to an hour. Use Revoke sessions on the user object so Outlook, Teams and mobile apps are forced to re-authenticate, which they now can't.
3. Reset the password. Belt and suspenders. It also locks out anything running on cached credentials, plus any personal service where the same password was reused.
4. Remove privileged roles and rotate shared secrets. If the person held admin roles, remove them. Rotate every credential they knew: Wi-Fi passphrases, shared admin accounts, alarm codes, password manager vaults.
5. Open the offboarding ticket. Log each action with a timestamp. If a dispute or a privacy incident surfaces later, this record is what proves you acted diligently.

The First Day: Devices, Mailbox and Licences

1. Retire or wipe the device in Intune. Company laptop? Wipe it remotely, a full factory reset, once you've confirmed nothing on it needs recovering. Personal phone enrolled in Intune? Retire it instead: company apps and data are removed while photos and personal apps stay untouched.
2. Convert the mailbox to a shared mailbox. Exchange Online lets a shared mailbox under 50 GB run without a licence. Convert first, remove the licence after, and the team keeps full access to the mail history.
3. Set an auto-reply and forwarding. Point clients to the replacement with a short auto-reply and forward incoming mail to the manager. Time-box both, 30 to 90 days is typical, and put the removal date in the ticket.
4. Reclaim the licence. Remove the Microsoft 365 licence and note it for the next renewal count. Unreclaimed licences are one of the most common cost leaks we find in small business tenants.
5. Plan the OneDrive transfer. Nothing is lost right away: once the account is eventually deleted, OneDrive keeps the files for 30 days by default, and you can extend that window in the SharePoint admin centre. Give the manager access now and copy whatever the team needs.

The First Week: Data Handover and the Long Tail

1. Transfer ownership of everything that runs. Teams the person owned, Planner boards, Power Automate flows, report subscriptions. Automations owned by a disabled account fail quietly, usually at the worst possible moment.
2. Clean up groups and distribution lists. Remove the account from distribution lists, Microsoft 365 groups and shared mailbox permissions. Assign new owners wherever the person was the only one.
3. Audit third-party SaaS access. Apps behind Entra single sign-on died with the account. Everything else needs a manual pass: accounting software, marketing platforms, industry portals, the company social media accounts. The password manager and the credit card statement are your two best sources for the full list.
4. Collect and reimage the hardware. Laptop, monitors, security keys, access cards. Reimage the laptop before reassigning it; the BitLocker recovery keys stay safe in Entra ID.
5. Close the ticket with a four-eyes review. A second person walks the checklist and signs off. Ten minutes of work that catches the missed step while it's still cheap to fix.

What Law 25 Requires You to Keep (and Delete)

Here's where offboarding stops being purely technical. Law 25 requires Quebec businesses to destroy or anonymize personal information once the purpose for collecting it has been fulfilled. A former employee's mailbox and files are full of personal information: theirs, your clients', their colleagues'. Keeping everything forever "just in case" is exactly what the law tells you not to do.

Deleting everything on day one is wrong too. Tax authorities generally expect payroll and financial records to be kept for six years, and contracts, disputes or CNESST files can impose their own timelines. The answer is a written retention schedule: which categories of data you keep, for how long, and when deletion actually happens. Our Law 25 guide for Microsoft 365 covers how to build one.

This is also where backup earns its keep. Dropsuite keeps a departed user's backed-up mailbox available after the Microsoft 365 licence is reclaimed. You apply your retention schedule, you can restore or export years later if a dispute demands it, and you still delete the live shared mailbox when its useful life ends. Pairing licence reclamation with backup and recovery gives you retention without the monthly licence bill.

FAQ

How fast should you disable a departing employee's account?

Within the first hour for a routine departure, and before the exit meeting ends for a contentious one. Blocking sign-in in Entra ID stops new logins, but tokens already issued can stay valid for up to an hour, so revoke sessions at the same time. Together the two actions take under five minutes.

Does converting a mailbox to shared really free up the licence?

Yes. A shared mailbox under 50 GB runs without a licence in Exchange Online, and the team keeps full access to the mail history. Two exceptions: if the mailbox has an online archive or sits under a litigation hold, it still needs a licence.

What happens to a former employee's OneDrive files?

As long as the account is only disabled, nothing changes. Once the account is deleted, OneDrive retains the files for 30 days by default, and administrators can extend that period in the SharePoint admin centre. The safer habit is to transfer anything the team needs during the first week, before deletion enters the picture.

Can we keep a former employee's mailbox forever under Law 25?

No. Law 25 requires destroying or anonymizing personal information once its purpose is fulfilled, and "we might want it someday" is not a purpose. Define a retention period that reflects your legal obligations, document it, and apply it to mailboxes, files and backups alike.

Every departure this season is a chance to run this list once, time it, and turn it into your own template. If you'd rather have someone else own the process, from the first-hour lockout to the Law 25 retention schedule, talk to us and we'll set it up with you.