Employee onboarding and offboarding in Microsoft 365: a secure process to avoid data loss and open access

Quick summary: employee onboarding and offboarding in Microsoft 365 in 10 points

1. The process starts in HR: IT needs a reliable signal for a new hire, role change, or departure in order to act on time.
2. Identity is the foundation: the user in Microsoft Entra ID must be created with accurate attributes: department, job title, manager, location, contract type, and start or departure date.
3. Licenses should be assigned through groups: this reduces errors, speeds up onboarding, and makes it easier to remove licenses when the person leaves.
4. Access must be minimal from day one: groups, Teams, SharePoint, and applications should be assigned by role, not by “copying” users without review.
5. Offboarding must block access before touching data: first block sign-in, revoke sessions, and protect credentials; then decide what to do with email, OneDrive, and teams.
6. Do not remove licenses without a data plan: removing certain licenses triggers limited retention periods; it is advisable to convert mailboxes, delegate OneDrive, and apply retention policies when needed.
7. Teams and SharePoint need new owners: if the employee was an owner of teams or sites, responsibility must be reassigned so spaces are not left orphaned.
8. Power Platform is often forgotten: flows, apps, connections, and automations may depend on a person’s account.
9. Devices matter: in Intune, you need to decide whether to retire, wipe, or reassign the device depending on whether it is corporate-owned or BYOD.
10. The process must be measured: onboarding time, access revocation time, orphaned access, recovered licenses, and post-offboarding incidents.

When do you need a formal onboarding and offboarding process in Microsoft 365?

Any company that uses Microsoft 365 needs a user onboarding and offboarding process. The difference is the level of maturity: some organizations handle it manually from the admin center; others integrate it with HR, groups, licenses, automated workflows, and access reviews.

Common scenarios

• Growing companies: new employees join every week, and email, Teams, OneDrive, licenses, and devices must be delivered without delays.
• High turnover: sectors with temporary staff, branches, stores, shifts, or operational teams where the risk of leaving access open multiplies.
• Hybrid or remote work: access does not depend on being in the office; that is why blocking identity, sessions, and devices is critical.
• Regulated environments: companies that need evidence of who had access, when it was removed, and which data was preserved.
• Intensive use of Teams and SharePoint: employees do not only have email; they are also owners of teams, sites, flows, apps, and documentation.
• Internal reorganizations: when a person changes department, it is not enough to add new permissions; old ones must also be removed.

Introduction

Employee management in Microsoft 365 does not begin when an account is created and does not end when a user is deleted. In a modern company, one identity touches many components: Microsoft Entra ID, Exchange Online, Teams, SharePoint, OneDrive, Intune, Defender, Purview, Power Platform, groups, SaaS applications, and, in many cases, on-premises systems.

That is why talking about employee onboarding and offboarding in Microsoft 365 means talking about security, productivity, and business continuity. Good onboarding allows a person to start working with the right tools from day one. Good offboarding prevents unauthorized access, preserves critical data, and leaves traceability for audits.

This guide is designed for IT, security, operations, and HR teams that want to move from a manual and improvised process to a more secure, repeatable, and auditable model. The goal is not to create bureaucracy: it is to remove uncertainty.

1. Joiner-mover-leaver methodology

In practice: the joiner-mover-leaver model structures the employee lifecycle: a person joins, changes role, and leaves.

Microsoft Entra ID Governance uses the joiner-mover-leaver approach to automate user lifecycle tasks. In plain language:

• Joiner: a person joins the organization and needs initial access.
• Mover: a person changes role, area, country, project, or responsibility.
• Leaver: a person leaves the organization or no longer needs access.

Why this model works

Because it prevents IT from acting only when “someone remembers.” The process is triggered by business events: hiring, role change, voluntary resignation, dismissal, contract end, leave of absence, a supplier finishing a project, or manager change.

The key is that each phase has an owner. If “everyone” is responsible for offboarding, in practice nobody is.

2. Assessment: inventory of identities, access, and critical data

In practice: before automating, you need to know what is being automated and what risks exist.

Many companies try to automate onboarding and offboarding without first reviewing their groups, licenses, permissions, and applications. The result is often a fast process, but not necessarily a secure one.

What the assessment should review

Expected outcome

The assessment should end with a clear roadmap: what can be automated immediately, what must be cleaned up first, which groups will be used for licensing, which data will be preserved during offboarding, and which roles must review access periodically.

3. Employee onboarding in Microsoft 365 step by step

In practice: good onboarding allows the person to work from day one without requesting access one by one.

Employee onboarding in Microsoft 365 should be predictable. The person should not start with “I don’t have email,” “I can’t see Teams,” or “I’m missing SharePoint access.” At the same time, they should not receive excessive permissions “just in case.”

3.1 Minimum data HR should send

• Full name and preferred name.
• Start date and contract type.
• Department, job title, location, and manager.
• Access profile: standard, executive, external, temporary, frontline, technical, privileged.
• Need for corporate device, mobile phone, groups, specific apps, or access to sensitive data.

3.2 User creation

The user can be created manually in the admin center, synchronized from on-premises Active Directory, or provisioned automatically from an HR system. In any case, it is important to standardize:

• UPN and primary email format.
• Email aliases, if applicable.
• Complete attributes to automate rules: department, country, manager, job title.
• Base groups according to role.

3.3 Group-based licensing

Group-based licensing in Microsoft Entra reduces errors: when a person joins the right group, they receive the correct license; when they leave, the license can be removed in a controlled way.

3.4 MFA, security registration, and Conditional Access

Onboarding should include MFA method registration, self-service password reset if used, and Conditional Access policies adapted to the profile. A new account without MFA is an open door.

3.5 Device, Intune, and applications

If the person receives a corporate laptop or mobile device, onboarding must be coordinated with Intune:

• Device assignment or Autopilot, if applicable.
• Compliance policies.
• Required applications.
• Configuration of Outlook, Teams, OneDrive, and the corporate browser.

4. Role changes: the forgotten part of the lifecycle

In practice: many access gaps are created when someone changes role and keeps old permissions.

Most companies have some onboarding and offboarding process. But internal changes are usually less controlled. An employee moves from sales to finance, from support to administration, or from one project to another, and accumulates historical permissions.

What should happen during a role change

1. Update attributes: department, job title, manager, location, and cost center.
2. Add new access: groups and applications for the new role.
3. Remove old access: team groups, SharePoint, Teams, applications, and shared mailboxes that no longer apply.
4. Review licenses: the required license type may change.
5. Review device: if the role requires higher security, compliance, or different apps.

Practical recommendation

Every role change should be treated as partial offboarding and partial onboarding: remove what no longer applies and deliver what is new.

5. Employee offboarding in Microsoft 365 step by step

In practice: secure offboarding quickly blocks access, preserves required data, and removes what should no longer remain active.

Employee offboarding should follow a clear order. If you delete the account first or remove licenses without thinking about data, you may lose email, OneDrive, evidence, or automations. If you take too long to block access, you leave a risk window open.

5.1 Types of departure

• Planned departure: retirement, contract end, agreed exit. Allows preparation for knowledge and data transfer.
• Immediate departure: dismissal, incident, security risk. Requires priority access blocking.
• Extended absence: medical leave, leave of absence, or temporary suspension. Does not always mean deleting the account.
• Supplier or external user: requires removing access to teams, sites, apps, and possibly deleting the guest user.

5.2 Recommended offboarding order

1. Confirm the departure: HR or an authorized owner sends a formal request.
2. Classify risk: normal, sensitive, immediate, legal/compliance.
3. Block sign-in: prevent the user from accessing Microsoft 365.
4. Revoke sessions: cut tokens and active sessions to reduce persistent access.
5. Change password: prevent known credentials from being reused.
6. Protect email and OneDrive: decide on forwarding, shared mailbox, delegation, or retention.
7. Reassign owners: Teams, SharePoint, groups, flows, apps, and shared mailboxes.
8. Remove groups and applications: eliminate access that no longer applies.
9. Manage devices: retire, wipe, block, or reassign depending on type.
10. Recover licenses: only when data and compliance have been resolved.
11. Save evidence: audit, ticket, approvals, and completed actions.

6. Exchange Online: mailbox, forwarding, automatic replies, and shared mailbox

In practice: the mailbox often contains critical information: customers, contracts, conversations, and decisions.

During offboarding, email is one of the most sensitive components. Blocking the account is not enough. You need to decide what happens to new messages and to the historical mailbox.

Common options

• Convert the mailbox to a shared mailbox: useful when several people need to consult the history.
• Grant delegated access to the manager: allows email review without sharing credentials.
• Configure forwarding: for new incoming emails, if the business requires it.
• Automatic reply: informs senders that the person is no longer there and redirects them to the correct contact.
• Inactive mailbox or retention: if there are legal or audit requirements.

What to avoid

• Do not share the former employee’s password.
• Do not remove the license without reviewing email preservation.
• Do not leave permanent forwarding without review.
• Do not depend on a personal account for business processes.

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"

# Block sign-in
Update-MgUser -UserId "user@company.com" -AccountEnabled:$false

# Revoke active sessions
Revoke-MgUserSignInSession -UserId "user@company.com"

Recommendation: adapt scripts to your environment, administrative roles, and approval process.

7. OneDrive and SharePoint: preserve data without leaving access open

In practice: OneDrive may contain business information even if it looks “personal.”

When an employee leaves, their files may be spread across OneDrive, SharePoint libraries, synced folders, Teams workspaces, and shared links. Offboarding must review all of this before deleting the account or permanently removing licenses.

The former employee’s OneDrive

• Assign temporary access to the manager or designated owner.
• Identify business documents and move them to SharePoint when appropriate.
• Review externally shared links.
• Apply retention if there are legal or contractual requirements.

SharePoint and team sites

• Review whether the employee was a site owner.
• Assign new owners before closing the account.
• Remove direct or unique permissions that no longer apply.
• Review sensitive libraries and external links.

Related MSAdvance reads: SharePoint as a document management system · Document automation with SharePoint and Power Automate.

8. Microsoft Teams: owners, channels, files, and meetings

In practice: if an employee was a Teams owner, their departure can leave teams without an accountable owner.

Microsoft Teams is not just chat. Behind it there are Microsoft 365 groups, SharePoint sites, files, channels, meetings, recordings, Planner, tabs, and applications. That is why offboarding must review:

• Teams where the user was an owner.
• Private or shared channels with specific permissions.
• Files posted in channels.
• Recurring meetings organized by the user.
• Recordings associated with meetings.
• Applications or tabs configured by the user.

Recommended actions

1. Assign a new owner to teams and groups.
2. Review private and shared channels.
3. Transfer or recreate recurring meetings if they are critical.
4. Review files and recordings containing sensitive information.
5. Remove guest access if the user is external.

Related resource: Microsoft Teams and Modern Workplace consulting.

9. Devices and Intune: retire, wipe, or reassign endpoints

In practice: a blocked identity is not always enough if sessions, data, or active devices remain.

Devices are a key part of offboarding. A corporate laptop is not the same as a personal mobile phone with access to Outlook and Teams.

Decisions by device type

What to review in Intune

• Devices associated with the user.
• Compliance status.
• Installed corporate applications.
• Wi-Fi, VPN, certificate profiles, and access to internal resources.
• BitLocker, recovery keys, and reprovisioning.

10. Applications, Power Platform, and service accounts

In practice: many departures break processes because a flow, app, or connector depended on a personal account.

In Microsoft 365 environments, employees can own:

• Power Automate flows.
• Internal Power Apps.
• Connections to SharePoint, Exchange, Dataverse, SQL, or APIs.
• Power BI reports and models.
• App registrations and secrets in Entra ID.
• Automations using personal accounts.

Recommended actions

1. Inventory the user’s flows, apps, and connections.
2. Change ownership to a service account or responsible team.
3. Reauthenticate critical connectors.
4. Review secrets, certificates, and application permissions.
5. Document the change for future audits.

11. Security: MFA, Conditional Access, sessions, and privileged roles

In practice: secure offboarding starts by blocking access and revoking active sessions.

Offboarding must act on identity immediately, especially when the departure involves risk. “Removing the license” is not enough. An account without a license, but still enabled in certain contexts, can remain a problem.

Key controls

• Block sign-in in Microsoft Entra ID.
• Revoke sessions to cut active tokens.
• Change password if the account is not deleted immediately.
• Remove MFA methods or record the authentication state, if applicable.
• Remove administrative roles and review PIM if used.
• Review enterprise applications and granted OAuth permissions.

Privileged accounts

If the user had administrative roles, access to Azure, security, billing, or sensitive data, the departure must be treated as a sensitive case. It is advisable to review:

• Roles in Entra ID.
• Roles in the Microsoft 365 admin center, Exchange, SharePoint, Teams, Intune, and Purview.
• Access to Azure subscriptions.
• Stored credentials, certificates, and secrets.
• Recent activity and administrative changes.

Related resource: Conditional Access in Microsoft Entra: baseline policies · MFA in Microsoft Entra ID.

12. Compliance: retention, eDiscovery, auditing, and evidence

In practice: not all data should be kept forever, but what must be retained has to be protected.

During offboarding, you need to decide what data is preserved, who can access it, and for how long. IT should not make this decision alone: legal, compliance, security, or the business owner should participate when appropriate.

Compliance questions

• Is there a legal obligation to preserve email or documents?
• Is there an open litigation, investigation, or audit?
• Did the user handle sensitive, financial, health, contractual, or confidential information?
• Should retention or eDiscovery be applied?
• Which evidence of the offboarding process is stored?

Recommended minimum evidence

• Formal offboarding request.
• Account blocking time.
• Session revocation.
• Actions on mailbox, OneDrive, Teams, and SharePoint.
• Devices retired or wiped.
• Licenses recovered.
• Legal/compliance approval, if applicable.

If your organization needs auditing, retention, DLP, or eDiscovery, see: Microsoft 365 Security & Compliance service.

13. Automation with Microsoft Entra ID Governance and Lifecycle Workflows

In practice: automating onboarding and offboarding reduces errors, but only if the role and group design is clear.

Microsoft Entra ID Governance enables user lifecycle task automation through Lifecycle Workflows. These workflows can help execute onboarding, role-change, and offboarding actions based on attributes such as start date, manager, department, or user type.

What can be automated

• Send welcome emails.
• Add users to groups.
• Assign tasks to the manager.
• Remove users from groups during offboarding.
• Run preparation actions for offboarding.
• Review workflow runs and reports.

Realistic automation

Not everything needs to be automated from day one. A healthy approach is to start with:

1. Standard onboarding with groups and licenses.
2. Standard offboarding with blocking, revocation, and group removal.
3. Manager and owner reviews.
4. Sensitive cases with human approval.

14. Licenses and costs: how to recover licenses without losing information

In practice: removing licenses saves costs, but doing it too early can cause data loss.

Many companies want to recover licenses quickly when a person leaves. That makes sense, but it has to be done in the right order. Before removing licenses, review whether you need to preserve the mailbox, OneDrive, Teams, compliance data, or temporary delegated access.

Best practices

• Use group-based licensing for onboarding and offboarding.
• Do not remove the license until you decide what happens to email and OneDrive.
• Convert the mailbox to a shared mailbox when appropriate.
• Apply retention if there is a legal obligation.
• Review Power BI, Power Apps, Visio, Project, Defender, Teams Phone, or other add-on licenses.

MSAdvance can also help you review licensing: Software license procurement and sales for businesses.

15. Operational checklists for onboarding, role changes, and offboarding

In practice: a checklist reduces errors and helps prove that the process was executed correctly.

15.1 Employee onboarding checklist

• Request approved by HR and the manager.
• User created or synchronized in Microsoft Entra ID.
• Complete attributes: department, job title, manager, location.
• License assigned through group.
• MFA and security methods configured.
• Groups, Teams, and SharePoint assigned by role.
• Device prepared in Intune, if applicable.
• Enterprise applications assigned.
• Welcome guide and best practices sent.

15.2 Role-change checklist

• New manager and department updated.
• New groups and apps assigned.
• Previous access reviewed and removed.
• Licenses adjusted.
• Access to sensitive data reviewed.
• Manager confirms that the user can work normally.

15.3 Employee offboarding checklist

• Formal request received.
• Account blocked.
• Sessions revoked.
• Password changed.
• Mailbox converted/delegated/retained depending on the case.
• OneDrive reviewed and access delegated to the responsible owner.
• Ownership of Teams, SharePoint, groups, and flows reassigned.
• Devices retired, wiped, or reassigned.
• Groups and applications removed.
• Licenses recovered after data protection.
• Evidence stored in a ticket or audit system.

16. KPIs and quality controls

In practice: if it is not measured, the process ends up depending on memory and goodwill.

17. Common risks and mitigations

In practice: the most serious risks often come from small steps nobody reviewed.

18. Useful scripts and snippets

In practice: scripts help, but they must be integrated into a process with approvals and evidence.

Connect-MgGraph -Scopes "User.ReadWrite.All"

$user = "user@company.com"

Update-MgUser -UserId $user -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $user

Connect-ExchangeOnline

Set-Mailbox -Identity "user@company.com" -Type Shared

Set-MailboxAutoReplyConfiguration -Identity "user@company.com" `
  -AutoReplyState Enabled `
  -InternalMessage "This person is no longer part of the organization. Contact support@company.com." `
  -ExternalMessage "This person is no longer part of the organization. Contact support@company.com."

{
  "user": "user@company.com",
  "offboardingType": "normal",
  "actions": {
    "blockSignIn": true,
    "revokeSessions": true,
    "reviewMailbox": true,
    "delegateOneDrive": true,
    "reassignTeamsSharePoint": true,
    "retireDevices": true,
    "recoverLicenses": "after_preserving_data"
  }
}

These examples are indicative. They must be tested in a controlled environment and adapted to permissions, roles, and internal policies.

19. Frequently asked questions about employee onboarding and offboarding in Microsoft 365

20. Official resources and external links

• Microsoft Learn — Add users and assign licenses in Microsoft 365
• Microsoft Learn — Remove a former employee and secure data
• Microsoft Learn — Give another employee access to OneDrive and Outlook data
• Microsoft Learn — Convert a user mailbox to a shared mailbox
• Microsoft Learn — OneDrive retention and deletion
• Microsoft Learn — What are Lifecycle Workflows?
• Microsoft Learn — Lifecycle Workflow tasks
• Microsoft Learn — Plan access reviews
• Microsoft Learn — Retention settings in Microsoft Purview
• Microsoft Learn — Group-based licensing in Microsoft Entra ID

MSAdvance internal resources

• Microsoft 365 Security & Compliance
• Modern Workplace Microsoft 365
• Conditional Access in Microsoft Entra
• Multi-factor authentication in Microsoft Entra ID
• Audit and monitor users in Entra ID
• All services

21. Conclusion and next steps

A good employee onboarding and offboarding process in Microsoft 365 is not limited to creating or deleting users. It must protect identity, data, email, OneDrive, SharePoint, Teams, devices, applications, and audit evidence.

If the organization wants to reduce risk, improve productivity, and avoid information loss, the next steps usually are:

• Document the current joiner-mover-leaver process.
• Review groups, licenses, and inherited permissions.
• Define onboarding, role-change, and offboarding checklists.
• Automate repeatable tasks with Microsoft Entra ID and groups.
• Measure onboarding time, blocking time, access removal, and recovered licenses.