When someone leaves, IT has a narrow window to protect data, preserve business continuity, and prevent a normal HR event from becoming a security incident. This Microsoft 365 offboarding checklist gives business leaders and IT teams a practical, step-by-step process for revoking access, preserving email and OneDrive content, handling devices, transferring ownership, and proving the work was done.
Need safer Microsoft 365 offboarding?
MSP Corp helps Canadian organizations tighten identity, endpoint, email, OneDrive, Teams, and admin processes so employee exits do not leave behind risky access, lost files, or licensing waste.
Departing employees create a strange mix of urgency and nuance. You need to stop access quickly, but you also need to keep the business running. You may need their mailbox for customer communication, their OneDrive for project files, their Teams memberships for ownership transfer, their mobile device wiped or retired, and their Microsoft 365 license reclaimed without deleting something the company still needs.
The safest approach is not “delete the user.” It is a controlled offboarding workflow: confirm the exit type, preserve the right data, revoke access, transfer ownership, remove unmanaged paths, recover the license, and verify the result. Microsoft’s own former-employee guidance separates these tasks into access blocking, mailbox preservation, mobile device handling, email forwarding or shared mailbox conversion, OneDrive and Outlook access, license removal, and account deletion.1, 3, 4, 6
CISA and MS-ISAC investigated an incident where a threat actor accessed a state government organization through a compromised former employee account, and CISA notes that threat actors commonly use valid accounts, including former-employee accounts that were not properly removed from Active Directory.14 That is why offboarding should be treated as an identity security control, not just an HR task.
What should happen when an employee leaves?
A clean offboarding process answers six questions before the employee’s access is removed:
For a normal, friendly departure, you can usually plan this workflow over several days. For an involuntary termination, compromised account, insider-risk concern, or privileged administrator exit, the timeline changes. Microsoft Entra guidance specifically lists compromised accounts, employee termination, and insider threats as scenarios where administrators may need to revoke all access.2
The M365 offboarding checklist at a glance
The table below is the practical version. Adapt it to your HR process, security policy, and Microsoft licensing model.
| Stage | What to do | Why it matters | Primary owner |
|---|---|---|---|
| Before departure | Confirm final working time, exit type, manager, data owner, legal hold needs, device inventory, and successor. | Prevents panic changes and reduces the chance of deleting or losing needed business records. | HR, manager, IT |
| At departure time | Block sign-in, revoke sessions, reset password where appropriate, remove admin roles, disable VPN and SaaS access. | Stops interactive and token-based access paths as quickly as possible.2 | IT/security |
| Mailbox handoff | Convert mailbox to shared mailbox or configure forwarding with approval. Assign access to the successor. | Keeps customer, vendor, and project communication moving without allowing the former employee to sign in.3 | IT, manager |
| OneDrive and files | Grant controlled access, copy or move required files, preserve important project folders, and remove temporary admin access later. | Microsoft notes that if the user account is deleted, there is a default 30-day window to access former-user OneDrive data unless retention is changed.4, 5 | IT, manager |
| Devices | Recover company devices, retire BYOD devices, wipe company-owned devices where needed, rotate BitLocker recovery access, and remove stale device records. | Removes managed apps, profiles, and company data from devices while matching the action to ownership type.9 | IT, HR |
| Teams, SharePoint, groups | Transfer ownership of Teams, SharePoint sites, Microsoft 365 groups, shared channels, Planner plans, Power Platform flows, and recurring meetings. | Prevents orphaned workspaces, missed approvals, broken automations, and unmanaged shared data. | IT, department owner |
| Licensing | Remove or reassign Microsoft 365 licenses only after hold, mailbox, data, and access requirements are understood. | Microsoft states that when a license is removed, user data is held for 30 days and after that most user content is permanently deleted, except documents stored in SharePoint.6 | IT, finance |
| Verification | Check sign-in logs, audit logs, mailbox permissions, forwarding rules, OAuth app permissions, device status, and ticket evidence. | Confirms the former employee is offboarded, the business has the data it needs, and no risky exceptions remain.10, 11 | IT/security |
Key takeaway: offboarding should be a workflow with evidence, not a one-click account deletion.
Step 1: Classify the departure before making changes
Not every departure needs the same handling. The first step is to classify the exit so IT can balance speed, data preservation, and risk.
Planned and low risk
The employee is leaving on good terms, has a known last day, and can assist with handoff. Use this time to document projects, transfer ownership, capture credentials held in approved vaults, confirm device return, and identify customer or vendor relationships.
Immediate or high risk
The exit is involuntary, the employee had privileged access, there is a suspected compromise, or there are insider-risk concerns. Access revocation should be coordinated for a specific time, and the first changes should focus on sign-in, sessions, admin roles, VPN, and sensitive SaaS tools.2, 14
The classification should be visible in the ticket. A departing salesperson with no admin privileges, a finance leader with sensitive exports, and a systems administrator with global admin rights should not follow the same risk path.
Step 2: Prepare the access inventory
The biggest offboarding misses usually happen outside the obvious Microsoft 365 account. Before the final access cutoff, create a fast access inventory.
Microsoft 365 and identity
- Microsoft Entra ID account
- Assigned licenses and service plans
- Admin roles, privileged identity assignments, and delegated admin rights
- Microsoft 365 groups, security groups, distribution lists, and dynamic groups
- Teams memberships and ownership
- SharePoint permissions, site ownership, sharing links, and external sharing exceptions
- Exchange mailbox permissions, forwarding rules, aliases, and shared mailbox access
- Conditional Access exclusions and named location exceptions
If your identity environment is messy because of acquisitions, old domains, duplicate accounts, or multiple tenants, address it as part of a broader identity consolidation effort. If your organization is merging Microsoft 365 environments, a structured plan for multiple tenant consolidation can prevent offboarding from becoming even harder.
Devices and endpoints
- Windows laptops, desktops, phones, tablets, and virtual desktops
- Intune enrollment status and compliance status
- BitLocker recovery key access and device ownership
- Local administrator accounts and cached credentials
- Remote access tools and support agents
- Personally owned devices with corporate apps or profiles
For BYOD devices, Microsoft Intune’s Retire action removes company data, managed apps, settings, and MDM profiles while preserving personal data, whereas wipe is a stronger action that resets the device and removes personal and organizational data. Match the action to the device ownership model and your policy.9 For companies still formalizing this, a clear BYOD security policy helps make offboarding decisions less subjective.
Third-party and SaaS access
- CRM, finance, HRIS, payroll, ticketing, project management, marketing, and password manager accounts
- VPN, firewall, SASE, ZTNA, and remote desktop access
- OAuth apps with delegated access to Microsoft 365 data
- Vendor portals, domain registrars, cloud consoles, social accounts, and shared inboxes
- AI tools, browser plugins, copilots, automation tools, and data connectors
OAuth app permissions deserve special attention. Microsoft Defender for Cloud Apps can show user-installed OAuth applications that have access to Microsoft 365 data, what permissions those apps have, and which users granted access.10 This matters because disabling a Microsoft 365 account is not the same as auditing every third-party app or connector that touched company data.
Step 3: Preserve business data before deleting anything
Departing employee data usually falls into three buckets: business records the company must keep, personal or unnecessary content that should not be broadly shared, and content that requires legal, compliance, or privacy review. Your offboarding process should separate those buckets before data is moved.
Microsoft allows admins to access a former employee’s OneDrive and Outlook data, back it up, and choose whether to grant another employee access.4 That does not mean every manager should receive everything. Access should be purposeful, time-bound, and tied to a business need.
Email and calendar
For most businesses, the cleanest mailbox handoff is to convert the user mailbox to a shared mailbox, grant access to the right successor, and prevent the former employee from signing in. Microsoft states that when a user mailbox is converted to a shared mailbox, existing email and calendar information is retained and multiple people can access it instead of one person.3
Be careful with three details:
- Convert before removing the license. Microsoft notes the user mailbox needs a license before you convert it to a shared mailbox, and after conversion you can remove the license from the user account.3
- Do not delete the old account too early. Microsoft notes the old user account anchors the shared mailbox.3
- Check mailbox size and hold requirements. Shared mailboxes without a license have limits, and holds may require the right Exchange Online licensing.3, 6
For customer-facing roles, configure an auto-reply and monitored handoff. Avoid silent forwarding with no owner, because it can turn into an unmanaged shadow mailbox. For legal, HR, finance, or regulated roles, confirm retention and eDiscovery requirements before changing mailbox state.
OneDrive
OneDrive is often where offboarding goes wrong. A manager may need client files, project notes, or draft documents, but broad access to a former employee’s OneDrive can expose personal, HR, or unrelated sensitive information. The better process is targeted access, targeted copy or move, then removal of temporary admin access once the handoff is done.
Microsoft’s current OneDrive deletion guidance says the cleanup process begins when a user account is deleted from Microsoft Entra ID, not merely when sign-in is blocked or a license is removed. The deleted user appears in the Microsoft 365 admin center for 30 days, and the default OneDrive retention period is also 30 days, although admins can change it in SharePoint admin center.5
That timing matters. If you delete first and plan later, you start a retention clock. If you preserve first and delete later, you reduce the chance of rushing through recovery.
SharePoint, Teams, and Microsoft 365 groups
Teams and SharePoint are shared spaces, but they still have owners. When an employee leaves, check whether they are the sole owner of any Teams, private channels, shared channels, SharePoint sites, Planner plans, lists, or Power Automate flows. Assign a new owner before removing the user from groups.
This is also the right time to review guest sharing and sensitive files. Departures often reveal that permissions have grown organically for years. If your files are also part of AI or Copilot readiness, align offboarding with Microsoft 365 Copilot readiness and AI governance, because over-permissioned content can become easier to surface through search and AI experiences.
Step 4: Revoke access in the right order
For a normal departure, access can be revoked at the agreed final working time. For a high-risk exit, HR, the manager, IT, and security should coordinate the exact minute changes begin. The order matters because modern Microsoft 365 access uses sessions, refresh tokens, devices, apps, and connected services.
Block sign-in
Block the user from signing in to Microsoft 365 and Microsoft Entra-connected services. Blocking sign-in stops new interactive sign-ins, but do not assume it instantly ends every session everywhere. Microsoft cautions that there can be a period between starting revocation and when access is effectively revoked, depending on the environment.2
Revoke sessions and tokens
Use Microsoft Entra access revocation steps to invalidate sessions and refresh tokens where appropriate. This is especially important when the employee used multiple devices, mobile apps, browsers, or had access to sensitive systems.2
Remove privileged roles first
Remove Global Administrator, Exchange Administrator, SharePoint Administrator, Teams Administrator, Intune Administrator, security roles, app registrations, service principal ownership, and privileged group memberships. For privileged exits, review break-glass accounts and Privileged Identity Management assignments as part of the same workflow.
Remove or update group memberships
Remove the user from Microsoft 365 groups, Teams, distribution lists, security groups, shared mailboxes, and role-based access groups. If the user is the only owner of a group or Team, assign a replacement owner first.
Disable non-Microsoft access
Disable VPN, firewall, RMM, PSA, CRM, HR, finance, payroll, developer, cloud console, backup, domain registrar, and third-party SaaS access. This is where many companies need help from a managed IT partner, because the Microsoft 365 account is only one part of the real access surface.
MFA helps reduce account takeover risk, but it does not replace account disablement, token revocation, group removal, device action, OAuth review, and conditional access review. For a stronger identity posture, pair offboarding with Conditional Access, least privilege, device compliance, and sign-in monitoring.
Step 5: Handle devices based on ownership and risk
Devices should be addressed quickly because they can contain cached files, tokens, offline mail, local admin rights, browser sessions, downloaded reports, or synced OneDrive content.
| Device scenario | Recommended handling | Watch for |
|---|---|---|
| Company-owned laptop returned on time | Recover device, confirm encryption, preserve needed data, wipe or reset before reassignment, update asset record. | Cached OneDrive files, local PST files, browser profiles, local admin accounts, VPN clients. |
| Company-owned laptop not returned | Disable access immediately, attempt remote lock or wipe where supported, escalate to HR/legal, track serial number and device state. | Offline data exposure, delayed check-in, unmanaged local accounts. |
| Personally owned phone or tablet | Use a managed app or MDM retire action where appropriate. Microsoft Intune Retire removes company data and management profiles while preserving personal data.9 | Personal privacy, unmanaged screenshots, saved files, third-party mail apps. |
| Privileged admin workstation | Preserve evidence if needed, rotate credentials, review logs, disable privileged access, wipe or rebuild before reuse. | Scripts, SSH keys, API keys, PowerShell history, cloud credentials, service account secrets. |
| Remote desktop or virtual desktop | Disable user assignment, revoke sessions, preserve profile data if required, remove persistent access paths. | Mapped drives, saved credentials, profile containers, shared session hosts. |
If your team offers round-the-clock support, define exactly who handles after-hours employee terminations, urgent account disablement, device lockout, and access verification. A documented understanding of what is included in 24/7 IT support prevents confusion during urgent exits.
Step 6: Transfer ownership of the work, not just the mailbox
Offboarding is complete only when business ownership is transferred. A mailbox handoff helps, but it does not cover all the places work lives.
Communication ownership
- Customer and vendor conversations
- Shared inboxes and aliases
- Recurring meetings and calendar ownership
- Teams chats and channel context
- Distribution list moderation
Operational ownership
- SharePoint sites and document libraries
- Planner plans, Loop workspaces, OneNote notebooks
- Power Automate flows and Power Apps
- Approvals, forms, reports, and dashboards
- Vendor portals and renewal notifications
For IT leaders, this is where offboarding overlaps with service desk quality. The ticket should not simply say “user disabled.” It should show what was transferred, what was retained, what was removed, and who accepted ownership. If your support model struggles with these handoffs, revisit how support responsibilities escalate across Tier 1 to Tier 3.
Step 7: Review forwarding, delegation, and mailbox rules
Email rules are a common blind spot. Before final closure, review:
- External forwarding rules
- Inbox rules that delete, hide, or move messages
- Delegate access
- Shared mailbox permissions
- Send As and Send on Behalf permissions
- Mobile device partnerships
- SMTP AUTH and legacy authentication exposure where still present
If the departure follows suspicious activity, treat hidden forwarding rules as potential indicators. Microsoft Purview Audit can be used to search user and admin activity, with Microsoft noting that audit search provides access to critical audit event data for investigating user activities.11 If a mailbox may have been abused, pair offboarding with an incident response plan and a basic triage workflow.
Step 8: Audit OAuth apps, AI tools, and unsanctioned integrations
Modern employees often connect third-party apps to Microsoft 365. Some are legitimate productivity tools. Others create unnecessary data exposure. Offboarding should include a review of user-consented apps, especially for employees in finance, HR, sales, IT, engineering, and executive roles.
Microsoft Defender for Cloud Apps can show which OAuth applications have access to Microsoft 365 data, what permissions they have, and which users granted those permissions.10 This is useful during offboarding because connected apps may have more access than the business realizes.
Employees may have used AI tools, browser extensions, data connectors, note-takers, transcription bots, or automation services. Include AI and app connector review in the offboarding checklist, especially if the employee handled confidential information, source code, contracts, customer records, employee records, or financial data. For broader governance, connect this with Copilot prompt practices and your AI approval process.
Step 9: Remove or reassign licenses carefully
License cleanup matters because unused licenses create cost waste. But removing a license too early can create data retention and access problems. Microsoft’s guidance says you can remove a former employee’s Microsoft 365 license and delete it from your subscription or assign it to another user, but you should understand holds and data access before removal.6
Use this decision path:
- Check legal or compliance hold needs. If a mailbox needs to be accessible for eDiscovery or legal reasons, confirm licensing and hold requirements first.6
- Convert the mailbox if needed. Convert to a shared mailbox before removing the user license when the mailbox must remain available.3
- Preserve required OneDrive data. Copy or move business files before the user account deletion process starts the OneDrive cleanup clock.5
- Remove unneeded service plans. Reclaim licenses only after data and access decisions are documented.
- Update the license inventory. Track reclaimed licenses, reassigned licenses, and any paid shared mailbox or archive requirements.
If licensing is already difficult to manage, MSP Corp’s IT procurement and Microsoft licensing support can help connect user lifecycle events with cost control, renewal planning, and subscription hygiene.
Turn offboarding into a repeatable managed IT workflow
We help standardize Microsoft 365 administration, end-user support, identity controls, backup decisions, and access reviews so every employee exit follows the same secure process.
Step 10: Validate with logs and evidence
Verification is where a checklist becomes a control. Before closing the ticket, collect enough evidence to show that access was revoked, data was handed off, and exceptions were approved.
For Canadian organizations that handle personal information, documentation matters. The Office of the Privacy Commissioner of Canada says safeguards can include physical measures, up-to-date technological tools, and organizational controls such as security clearances, limiting access, staff training, and agreements.12 In a privacy breach context, PIPEDA also requires organizations to keep records of every breach of security safeguards involving personal information under their control for two years.13
Special case: The departing employee is an administrator
Administrator exits deserve a stricter runbook. Admin accounts can touch identity, email, endpoints, backup, security tools, DNS, firewalls, cloud subscriptions, and remote support tools. If the departing person had privileged access, add these actions:
- Remove all privileged Microsoft Entra and Microsoft 365 admin roles.
- Review Privileged Identity Management assignments and eligible roles.
- Rotate shared admin credentials, break-glass credentials where policy requires, API keys, app secrets, SSH keys, backup console credentials, RMM credentials, and firewall/VPN secrets.
- Review service accounts the admin created or maintained.
- Inspect recent administrative activity in Microsoft Purview Audit, Entra logs, endpoint tools, backup tools, and remote access systems.
- Confirm no personal email, phone number, or authenticator method remains attached to admin, service, or break-glass accounts.
- Check for newly created accounts, role assignments, mailbox rules, external sharing changes, app registrations, and consented applications.
- Document all exceptions and obtain executive approval before leaving any privileged access active.
If the administrator exit is part of an acquisition, merger, or IT leadership change, combine this checklist with an IT post-acquisition stabilization process, because inherited admin access, old vendor accounts, and legacy tools are common risk areas.
Special case: The departure may involve a security incident
If there is any sign of suspicious activity, do not treat offboarding as routine. Preserve evidence first, coordinate with leadership, and follow your incident process.
Signs to escalate
- Unusual downloads or mass file access before departure
- Mailbox forwarding to external addresses
- Unexpected OAuth app consent
- Suspicious sign-ins or impossible travel
- Deleted files, altered logs, or changed permissions
- New admin accounts or role changes
Immediate response
- Revoke access and sessions
- Preserve logs and device evidence
- Review audit activity
- Confirm data exposure scope
- Engage legal, privacy, and security leadership
- Track breach assessment decisions
When suspicious activity is involved, it may also be appropriate to run an incident triage workflow, document lessons learned with an RCA, and confirm whether Microsoft 365 backup coverage is adequate for restore scenarios.
Special case: Contractors, vendors, and temporary staff
Contractors are often harder to offboard than employees because they may sit outside HR systems, use guest accounts, work across multiple tenants, or rely on personal devices. Treat contractor offboarding as a lifecycle process:
- Use named accounts, not shared accounts.
- Set an account expiration date when the contract begins.
- Require a business owner for each contractor account.
- Limit access to specific groups, sites, channels, and apps.
- Review guest accounts and external sharing monthly.
- Disable access on the contract end date, not when someone remembers.
Microsoft Entra lifecycle workflows can help automate scheduled leaver processes, including removing licenses, removing a user from Teams, and deleting the user account in a scheduled offboarding scenario.7 Microsoft also documents on-demand lifecycle workflows for real-time terminations that remove the user from groups, remove Teams memberships, and delete the user account.8
What not to do when someone leaves
These mistakes are common, especially in organizations where IT is stretched thin or documentation is out of date.
Do not delete the account first
Deletion can start retention timelines and make mailbox or OneDrive recovery more difficult. Preserve and transfer what the business needs before deleting the account.3, 5
Do not leave shared passwords unchanged
If the employee knew shared credentials, rotate them. Better yet, replace shared accounts with named accounts and privileged access management.
Do not forward email forever
Forwarding is useful during transition, but it needs an owner, expiry date, and review. Long-lived forwarding can create privacy and security issues.
Do not skip SaaS and OAuth access
Microsoft 365 access is only part of the picture. OAuth apps, cloud tools, browser extensions, and SaaS accounts can retain access to business data if nobody checks them.10
Do not ignore privileged exits
Admins require credential rotation, log review, role verification, and system ownership transfer. CISA’s former-employee account advisory shows why stale privileged access can become a serious exposure.14
A practical offboarding ticket template
Use this as a starting point for your internal ITSM tool.
| Field | What to capture |
|---|---|
| Employee details | Name, role, department, manager, location, employee type, final working date and time. |
| Risk classification | Planned, immediate, high-risk, privileged, contractor, suspected security incident, legal hold required. |
| Access cutoff | Exact time access should be blocked, who approved it, and who will execute it. |
| Identity actions | Block sign-in, revoke sessions, remove roles, remove groups, remove MFA methods where required by policy, disable VPN and SaaS access. |
| Mailbox actions | Convert to shared mailbox, assign access, configure auto-reply, approve forwarding, check inbox rules and delegates. |
| File actions | OneDrive access, required folders, SharePoint ownership, Teams ownership, retention decision, temporary access removal date. |
| Device actions | Assets assigned, return status, Intune retire or wipe, local data preservation, encryption, rebuild status. |
| App actions | SaaS disablement, OAuth review, CRM ownership, payroll/HR, project tools, cloud platforms, AI tools. |
| License actions | Licenses retained, removed, reassigned, or required for hold/archive/shared mailbox purposes. |
| Evidence | Approvals, timestamps, validation notes, audit log exports, screenshots if appropriate, exceptions and owner. |
How MSP Corp helps make offboarding safer
Offboarding is not difficult because the individual steps are impossible. It is difficult because the steps live across HR, management, Microsoft 365, Entra ID, Exchange, SharePoint, Teams, Intune, security tools, SaaS systems, devices, backups, and documentation. When those responsibilities are unclear, former employees can keep access too long, business files can disappear, and managers can lose visibility into critical work.
MSP Corp helps organizations bring this under control with managed IT services, Microsoft 365 management, Microsoft Entra services, Intune endpoint management, data governance and compliance, and co-managed IT support for internal teams that need extra capacity.
If your current provider cannot give you a reliable user lifecycle process, that may be one sign it is time to evaluate whether your MSP still fits your business. Departures should not depend on heroics, memory, or “the person who usually knows.” They should run from a documented process that protects the organization every time.
Frequently asked questions
Should we delete a departing employee’s Microsoft 365 account immediately?
Usually, no. First block sign-in, revoke sessions, preserve needed email and files, transfer ownership, confirm legal or compliance requirements, and then remove licenses or delete the account when appropriate. Microsoft’s former-employee workflow separates access blocking, mailbox preservation, device handling, email forwarding or shared mailbox conversion, OneDrive access, license removal, and account deletion.1
What is the safest way to keep a former employee’s email available?
For many organizations, converting the user mailbox to a shared mailbox is safer than keeping the user account active. Microsoft states that conversion retains existing email and calendar information and lets several people access the mailbox instead of one person.3 Make sure the former employee cannot sign in, and assign access only to approved users.
How long do we have to access a former employee’s OneDrive?
Microsoft states that if you delete the user account, you have 30 days by default to access the former user’s OneDrive data unless the retention period is changed, and the OneDrive deletion process begins when the user account is deleted from Microsoft Entra ID.4, 5 Preserve business-critical files before relying on default retention windows.
Should we wipe a departing employee’s personal phone?
Not by default. For personally owned devices, use your BYOD policy and the appropriate management action. Microsoft Intune’s Retire action removes company data, managed apps, settings, and management profiles while preserving personal data.9 Full wipe is typically reserved for company-owned devices or scenarios where policy, consent, and risk justify it.
What if the departing employee had admin access?
Treat it as a privileged offboarding event. Remove admin roles, revoke sessions, rotate shared secrets, review app registrations, inspect audit logs, verify no backup access remains, and document the results. CISA has documented a real incident involving a compromised former employee administrator account, which shows why stale admin access is dangerous.14
Can Microsoft Entra automate offboarding?
Yes, depending on licensing and requirements. Microsoft Entra ID Governance lifecycle workflows can support scheduled leaver scenarios, including removing licenses, removing a user from Teams, and deleting the user account. Microsoft also documents on-demand termination workflows for real-time scenarios.7, 8
Get a cleaner, safer way to manage employee exits
If offboarding still depends on manual memory, scattered spreadsheets, or an overworked internal team, MSP Corp can help you build a secure Microsoft 365 lifecycle process that protects access, data, devices, and continuity.
References
- Microsoft Learn: Remove a former employee from Microsoft 365
- Microsoft Learn: Revoke user access in Microsoft Entra ID
- Microsoft Learn: Convert a user mailbox to a shared mailbox
- Microsoft Learn: Give another employee access to OneDrive and Outlook data
- Microsoft Learn: OneDrive retention and deletion
- Microsoft Learn: Remove and delete a Microsoft 365 for business license from a former employee
- Microsoft Learn: Automate employee offboarding tasks after the last day of work with Microsoft Entra
- Microsoft Learn: Execute employee termination tasks using lifecycle workflows
- Microsoft Learn: Intune device action, Retire
- Microsoft Learn: Manage OAuth apps in Microsoft Defender for Cloud Apps
- Microsoft Learn: Search the audit log in Microsoft Purview
- Office of the Privacy Commissioner of Canada: PIPEDA Fair Information Principle 7, Safeguards
- Office of the Privacy Commissioner of Canada: Mandatory reporting of breaches of security safeguards
- CISA: Threat actor leverages compromised account of former employee
- CISA: Remove extraneous and stale accounts
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations