Employee Offboarding Checklist For Microsoft 365 And Business Systems

01

The Short Offboarding Checklist

“Who is receiving their customer emails?” and “Where are the job files?” should have clear answers before the departure becomes a scramble. Ultra IT can help Sunshine Coast and Gympie teams organise the access changes, Microsoft 365 handover and device work into a practical, documented process.

Use this as a coordination checklist, not an instruction to delete everything immediately. Sensitive departures, suspected misuse, records subject to a hold and unusual tenant configurations need an authorised specialist plan. The business decides who may see employee information; an IT checklist does not replace its HR, privacy or legal obligations.

• 1. Name the people and timing. Record the approver, executor, departure time and person receiving the work.
• 2. List the environment. Identify business accounts, administrator access, shared secrets, devices and important ongoing tasks.
• 3. Secure access. Complete the authorised sign-in, password and session controls at the agreed time.
• 4. Choose the email outcome. Verify the mailbox, calendar and incoming-email arrangements.
• 5. Preserve the files and work. Keep needed OneDrive files and transfer working records and application ownership.
• 6. Recover equipment and close other access. Include remaining application, remote and physical access.
• 7. Verify and close the task. Check the handover, resolve exceptions, then review licences and account disposal.

02

1. Agree Who Can Authorise The Change

Record the employee's name, exact business account, manager, agreed access cut-off and the person who will inherit the work. Have an authorised business representative approve the change. For a planned departure, collect the operational handover beforehand where appropriate. For an urgent departure, coordinate the timing privately with the authorised decision-maker.

Keep the record precise enough to avoid disabling the wrong person or transferring confidential material to someone who does not need it. Separate the decision from execution: the manager approves access and information handling; the technician records what was changed and what remains unresolved.

Confirm whether any investigation, retention requirement or existing hold affects the records. Obtain appropriate advice before altering affected data. Do not put personnel disputes, passwords or sensitive documents into an ordinary support enquiry.

03

2. Make The Account And Work Inventory

Start with the systems the person actually used, rather than assuming the email account is the whole environment. For a receptionist that might include appointments and a phone system; for a field technician, job software, site access and a company handset; for a bookkeeper, finance and supplier approvals.

List the relevant accounts and the action owner for each. Mark business-critical tasks separately. A supplier order, booking queue or reporting integration needs a new responsible person, not just a disabled login. The ACSC's access-control guidance supports checking all relevant systems and changing shared passwords known to a departing person. Plan those changes so authorised colleagues can continue working.

• Microsoft 365, any separate Google Workspace identity and business email.
• CRM, job management, accounting, payroll and payment applications.
• Website administration, domain and hosting access, social accounts and online stores.
• VPN, remote-support tools, password-manager membership and device sign-in.
• Team inboxes, groups, shared folders, external collaboration and supplier portals.
• Company laptops, phones, security keys, access cards and other issued equipment.
• Scheduled reports, recurring meetings, integrations and other work tied to the person's account.

04

3. Secure Microsoft 365 Access At The Agreed Time

An authorised administrator should follow Microsoft's former-employee sign-in guidance, including the applicable password reset, sign-out and sign-in blocking steps. Use the appropriate administrative role, not unnecessary permanent elevated access.

Do not treat a password change or one green status as proof that every existing session has ended. Microsoft documents timing differences between account blocking, session sign-out and services. Verify the relevant access state and escalate an urgent or suspected-compromise case rather than promising instant removal everywhere.

If accounts are synchronised from a local directory, involve the administrator responsible for that environment, as described in Microsoft's offboarding overview. Check other business applications independently. This is an account-control task; it does not remove copies of information already downloaded to a device.

05

4. Keep Email And Customer Work With The Business

Agree what should happen to the departing person's incoming messages and historical email. The right answer may be an approved shared mailbox, a named recipient for new messages, a records-preservation arrangement or a combination that fits the business's requirements.

Microsoft distinguishes forwarding new email from converting a mailbox. Forwarding is not a historical-email handover. For a shared mailbox, confirm the size, archive and hold requirements before removing its licence; licensing requirements vary. Keep its associated account where required and prevent the former employee signing in. A mailbox conversion alone is not an access-control process. See Microsoft's conversion prerequisites.

Then make the customer-facing handover useful. Name who checks messages, approves replies and deals with open work. Review ongoing meetings, room bookings and shared calendars so customers are not left waiting for a departed organiser.

For clarity on the available mailbox types, read our shared mailbox, alias and user-account comparison. Grant only the access the receiving person is authorised to use.

06

5. Preserve Files And Transfer Responsibilities

Identify the files needed for current jobs and records before deleting an account. Give an approved successor access or move the agreed working files into a business-controlled location. Microsoft's OneDrive handover guidance covers administrative access and transferring files, including a warning about version history when copying or moving documents. Check history requirements before choosing the transfer method.

Do not rely on “we can recover it later.” OneDrive retention and deletion rules depend on account deletion, licensing and applicable policies. Retaining an unlicensed account is not a promise of indefinitely accessible files. Confirm the tenant's current settings and the required preservation method.

Test the important working documents from the successor's account. Check links, permissions and any workflow that used the former employee as an owner or approver. Record where the retained material lives, who may access it and when that access will be reviewed.

07

6. Recover Devices And Close The Remaining Access

Reconcile the issued-equipment list with what was returned. Record the asset, condition, accessories and collection outcome. Before redeploying equipment, confirm that business files, encryption recovery information and the approved preparation process are covered.

Treat company-owned equipment and personal devices differently. Any remote removal of business data or device reset needs appropriate authority, a supported management method and a checked scope. Avoid a blanket wipe that could remove personal information or business records that have not been preserved.

Close or transfer access in each remaining application. Review shared secrets and memberships, administrator roles, remote connections and physical access. If a scheduled integration depends on the person's identity, arrange a supported business-owned replacement and test it before retiring the old dependency.

For custom software, the handover may include record ownership, approval queues, API connections or scheduled jobs. Ultra IT's developer-led support can help identify those dependencies as well as the account changes; the work is scoped to the actual system rather than assuming every platform behaves like Microsoft 365.

08

7. Verify The Handover Before Closing The Task

An offboarding task is finished when the agreed controls and working handover have evidence, not merely when somebody clicks “remove user.” Keep a short closure record.

Resolve remaining licence needs after preservation and mailbox decisions. Check the account dependencies before disposal. Preserve a record of the business approval and the verification, without storing plaintext credentials in the checklist.

Make the record part of the next role-change review. A small business can maintain a simple checklist; a growing team can build a repeatable joiner, mover and leaver process with its IT provider. The useful result is a known owner and a checked outcome for each system.

• Approver, executor and completed access cut-off.
• Systems checked, actions completed and outstanding exceptions.
• Mailbox outcome and successful incoming-message/recipient checks.
• Required files accessible to the authorised successor.
• Ongoing jobs, approvals and integrations reassigned and tested.
• Equipment received or an agreed recovery action.
• Licence and account decisions, required retention and next review date.

09

Get A Practical Staff Access And Handover Plan

Ultra IT can help with staff access reviews, Microsoft 365 administration, device handover and separately scoped business-system work. Our local Sunshine Coast team supports businesses across the Sunshine Coast and Gympie with a clear route to technical help.

Start with a Managed IT fit review if you want a repeatable team process. Managed IT Core starts from $239 per month for monitoring and maintenance of up to five eligible devices. Support labour, Microsoft 365 administration, licences, security, backup and projects are separately scoped unless your written plan includes them. An individual offboarding job can also be discussed through Microsoft 365 support.

Tell us your team size, platforms, timing and where the handover gets stuck. We can agree the practical next step and the required authorisation. Keep employee records, passwords and MFA codes out of the public enquiry form.