When an employee leaves, several systems need access revoked promptly. This checklist gets it done correctly.

1. Coordinate with HR

Departures usually have an end date. IT actions should align:

  • Last day of work: account remains active during business hours
  • After hours of last day: account fully revoked

For involuntary departures: revoke immediately during the exit conversation.

2. Microsoft 365 account

  • Reset password to a long random string (prevents continued access)
  • Sign out of all sessions: aka.ms/o365-sign-out-all (admin action)
  • Block sign-in
  • Set up email forwarding to a manager or shared mailbox
  • Out-of-office auto-reply explaining departure

3. Email content

Decide what happens to email:

  • Convert mailbox to shared mailbox (keeps emails accessible)
  • Export to PST for archive
  • Delete after retention period

Many orgs retain mailboxes for 90 days, then convert or delete.

4. OneDrive content

  • Convert OneDrive ownership to manager
  • Manager reviews, retains business files, deletes personal
  • Set retention period for unattended OneDrives

5. Active Directory / single sign-on

  • Disable account in AD (don't delete yet — many systems reference it)
  • After retention period (typically 90 days), delete

6. SaaS applications

Each app that uses SSO will inherit the disabled SSO. Apps with separate accounts need individual action:

  • Salesforce, HubSpot, Jira, GitHub, etc.
  • Each needs the user revoked
  • Reassign their work / records to other team members

7. VPN access

  • Disable VPN account
  • Remove from access groups

8. Mobile devices

If the company owns the device:

  • Remote wipe via Intune or similar
  • Confirm wipe completed
  • Collect physical device

If BYOD:

  • Wipe only company data (selective wipe)
  • Confirm before removing from corporate management

9. Physical access

  • Disable building access badge
  • Collect physical keys
  • Update visitor / employee directory

10. Sensitive credentials

  • Identify shared accounts they had access to
  • Change passwords on those
  • Rotate API keys they may have known
  • Revoke their personal keys (SSH, GPG)

11. Communication

  • Update org chart
  • Notify customers if they were a customer-facing role
  • Update email signatures of others if they're listed
  • Adjust mailing lists

12. Equipment return

  • Laptop
  • Phone (if company-issued)
  • Monitor / accessories
  • Headset, dock, peripherals
  • Keys / badges

Documentation

Keep records of:

  • Date of last access
  • What was revoked and when
  • Equipment return signed off
  • Mailbox / OneDrive disposition

Useful for audits and legal.

Common omissions

Frequently forgotten:

  • Backup credentials saved in someone's email
  • Personal Microsoft account linked to work files
  • Mobile apps signed in
  • Specific browser bookmarks/sessions
  • Custom integrations they set up

When to ticket

For most departures, IT runs this process. Raise a ticket if:

  • Departure is happening today/immediately
  • You're a manager handling exit conversation
  • You need access transferred to specific colleagues
  • Equipment return is incomplete

Include the departing employee's name, last day, and any special considerations.