When an employee leaves your company, there is usually a lot to take care of. You may think about the handover, final paperwork, or finding a replacement. But there is one important task that is often overlooked: IT security. The moment an employee leaves, their access to company systems, emails, files, and customer data must be handled carefully. If their accounts remain active, they may still be able to access sensitive business information — even weeks after their last working day.
For many small businesses, Microsoft 365 is at the center of daily operations. It contains important emails, business documents, customer information, and shared files. Without a clear offboarding process, former employees may keep access to this information. This can lead to data leaks, unauthorized access, or the loss of confidential business data. The good news is that many of these risks can be prevented with a few important steps.
In this article, I will show you how to manage employee offboarding in Microsoft 365. I will walk you through the most important security checks, explain which access rights need to be removed, and show you how to protect your company’s data.
Why the Offboarding Moment Is So Important
The best offboarding starts before the employee leaves. Decide who is responsible for each step and write it down. In a small company this is often the owner or the office manager, together with your IT provider. Agree on the exact time when the access will be closed. If the departure is friendly and planned, you can close access at the end of the last working day. If the person was dismissed or the situation is tense, close it at the moment the conversation starts. Even a few hours of open access can be enough to copy or delete important data.
When someone leaves on bad terms, there is a real temptation to take customer lists, price documents, or internal know-how along to the next job. Studies on insider incidents consistently show that most data theft by employees happens shortly before they leave, not out of long-term malice but simply because the opportunity is right in front of them. The anger of a disputed termination, the fear of starting a new job without useful material, or just the wish to “keep a copy for myself” can turn an ordinary, loyal employee into a data risk in a matter of days. When someone leaves in a hurry, the situation is different but the outcome is similar. A sudden resignation, a dismissal with immediate effect, or a reorganization leaves no time to check what access the person actually had. The laptop comes back at the end of the day, everyone is busy, and the account itself is forgotten because it is invisible. Unlike a physical key, a digital account does not sit on anyone’s desk as a reminder. It stays in the cloud, fully functional, and nobody in the office can see it.
And when someone leaves quietly and on good terms, the risk is the least visible of all. Everyone assumes there is nothing to worry about, so nothing gets checked at all. The employee says goodbye with a smile, promises to stay in touch, and two years later their account still exists with full access to your SharePoint sites and Teams channels. Meanwhile, their password has been part of five data breaches at other services where they reused it, and their old mailbox is still collecting your customers’ emails. Trusting your people is healthy and important, but trust is not a security control. All three situations create the same result: an account that is no longer needed but still exists, with access nobody has reviewed and a password nobody has changed.
The problem grows with time. In many SMEs, nobody is formally responsible for offboarding. HR tells the team leader, the team leader hopes IT will handle it, and IT only hears about it if the manager remembers to send an email. Each of these handoffs is a place where the process can silently stop, and in a company without a dedicated IT security team, there is often nobody whose actual job description includes catching that drop. The result is predictable: in most small businesses you will find at least one or two accounts of former employees that were never properly closed. Sometimes they are discovered by accident, during a license audit or when a customer suddenly receives an out-of-office reply from someone who left three years ago.
Microsoft 365 makes this worse in one specific way: it is designed for convenience. Accounts stay active as long as a license is assigned, and a mailbox keeps receiving email even if the person never logs in again. Microsoft will not warn you that this user has been inactive for six months; from the system’s point of view, everything is working exactly as intended. The license even keeps costing you money every month, turning an unmanaged security risk into a small, invisible ongoing expense. That means the risk does not disappear on its own. It simply waits, patiently, until the day a criminal finds the old credentials in a stolen password list, or a former employee logs in out of curiosity and finds they still can
Block Access Immediately — Before Anything Else
Protect the Email and the Mailbox
After you block the access, you need to decide what happens to the mailbox. An employee’s emails often contain contracts, customer talks and decisions that your company will need later. So do not delete them. The best way is to turn the mailbox into a shared mailbox. This does not need a paid license, and a manager or a colleague can read and answer the emails that arrive at the old address. Also set up an automatic reply that tells senders who their new contact person is. Customers and partners will keep writing to the old address for months, so this reply is very helpful. If you prefer, you can also forward all new emails to the successor for a short time.
Many companies forget one more thing: forwarding rules. Employees sometimes create a rule that sends all their emails to a private address. This rule keeps working even after you block the account. That is why you should always check the mailbox for forwarding rules, inbox rules and access rights given to other people. Remove everything that does not belong to your new setup. Before you delete anything, think about keeping the emails for a longer time. In many countries, the law says you must store business emails for several years. In Microsoft 365, you can use a retention policy or a litigation hold for this. It is a good idea to ask your IT provider or a legal advisor how long you need to keep them in your country.
Secure Files in OneDrive and SharePoint
Check admin rights and connected apps
If the person who leaves had special rights, remove them on the same day. This step is easy to forget, and it can cause the most damage. An account with admin rights can change settings, read other people’s data and create new users. If an attacker takes over such an account, they do not need any other door. Start in the Microsoft 365 admin center and look at the roles of the employee. Many people think that only the IT person has admin rights. In reality, rights often spread over the years. A colleague may have become SharePoint administrator for one project, or received the right to reset passwords for the team. Nobody removed it afterwards, and nobody remembers it today. Check the list of roles carefully and remove every role that the person no longer needs. If the person was the only administrator in your company, make sure that a second trusted person has full access before you close the account. Otherwise you may lock yourself out.
Next, look at the connected apps. When employees use a new tool, Microsoft 365 often asks: “Do you allow this app to read your emails and files?” Many people click yes without thinking. These apps can be useful, for example a calendar tool, a note-taking app or a service that sends invoices. But each of them receives a kind of permanent key to the account. This key can keep working even after you change the password. That is why it is not enough to block the sign-in and hope that everything stops.
Do not forget the tools outside of Microsoft 365. Think about your accounting software, your customer database, your website, your online shop and your social media accounts. Many small companies use one shared password for several of these tools, or they keep passwords in a spreadsheet. If the former employee knew such a password, change it on the last day. This is one of the most common gaps in small companies, and it is also one of the easiest to close.
Remove the license and delete the account later
Only remove the license when you are sure that all important data is safe. This is the point where many companies make a costly mistake. They remove the license too early, or they delete the account on the last day, and a few weeks later someone asks for an old email or a file that is no longer there. Microsoft keeps deleted data for a limited time, but this time is short, and getting it back can be difficult.
Most small companies keep the blocked account for thirty to ninety days. The right length depends on your business. If your employees handle long projects or yearly contracts, a longer period makes sense. Some things only show up weeks later, for example when a customer asks for an old offer or when an automatic task stops working because it was linked to the former employee. Keep in mind that a deleted account does not disappear at once. Microsoft keeps it in a recycle bin for thirty days, and you can restore it during this time. After that, the account and its data are gone for good. This is a helpful safety net, but you should not rely on it. Treat the deletion as a final step, not as a test.
Before you delete the account, go through a short final check. Ask the manager if anything is missing. Look at the list of tools and accounts that the person used and confirm that each of them has been closed or handed over. Check that no shared mailbox, group or automated process still depends on this account.
Make it a routine
The most important step is to turn all these points into a fixed process. A list in your head is not enough. When a team member leaves, the days are usually busy, and small tasks are easily forgotten. A written checklist makes sure that nothing is missed, even when you are in a hurry or when a different person takes care of the departure.
Write one checklist and keep it in a place that everyone who needs it can find, for example in a shared folder or in your internal wiki. Name one person who is responsible for it, and name a second person who can take over when the first one is away. Add a date and a name to each step, so you can see later who did what and when. After every departure, take five minutes to ask yourself what worked well and what was missing. Then improve the list. Over time, it becomes a tool that fits your company perfectly.
Use the same idea for new employees. When someone joins, give them only the access they need for their job, and write it down. This makes the later offboarding much easier, because you already know what to close. The same is true for people who change roles inside the company. Old rights often stay behind when someone moves to a new job, and they grow unseen over the years. A short review of the access rights at the moment of the change keeps this under control.
Clean Up Accounts, Licenses, and Admin Roles
When the data is safe, you can clean up the account itself. This step matters more than many people think. Start with the admin roles. Check if the employee had special rights, such as Global Administrator or SharePoint Administrator. If these rights stay on an account that nobody uses, they create a hidden risk. Attackers look for forgotten accounts with high rights, because nobody watches them. Next, remove the person from all groups, mailing lists and Teams. Look at your automated processes too, for example Power Automate flows, and check if the account is still the owner of a shared mailbox. When the owner disappears, these processes can stop without any warning.
Do not rush to delete the account. First remove the Microsoft 365 license and keep the account blocked for a few months. This gives you a safety net in case you find that something is missing. Delete the account only when you are sure that everything has been moved to a new owner. Write down every step you took, with the date and the person who did it. This record helps in internal checks. It can also be important proof if a data protection problem happens later.
Conclusion – Microsoft 365 offboarding checklist for small business
When an employee leaves, the Microsoft 365 account stays behind with all its emails, files and connections. If nobody closes it, it becomes an open door that no one watches. The good news is that you do not need special tools or a large IT team to fix this. You need a clear plan, a person who is responsible and the habit to use the plan every single time.
The most important steps are simple. Block the sign-in and end all active sessions on the last day, or at the start of a difficult conversation. Remove the second login method and the devices of the person. Make sure a colleague can access the mailbox and the important files. Take away admin rights and connected apps, and change every shared password that the person knew. Keep the account for a few weeks, watch the sign-in logs and delete it only when you are sure that nothing is missing.
A Microsoft 365 offboarding checklist for small business only works if you use it. Write it down once, store it where everyone can find it and go through it with every departure. The same list helps when someone changes roles, because old access rights often stay behind and grow unseen over the years. A short routine today protects you from a problem that can stay hidden for months.
If you are not sure where your company stands, start with one question: could a former employee still log in to your systems today? If you cannot answer with a clear no, it is time to look at your process.
5 Microsoft 365 Security Settings Every Small Business Should Enable
How Hackers Break Into Microsoft 365 — and How You Can Stop Them
How Safe Is Your Business Email? 7 Things You Should Check Today
