An IT onboarding and offboarding checklist makes sure new employees get the right access on day one and departing employees lose access immediately, without losing company data. In Microsoft 365 environments, that means consistent steps for Entra ID accounts, licenses, groups, devices, mailboxes, OneDrive files and app access. Missed offboarding steps are a common security gap, especially when former employees keep access to email, files or SaaS apps.
Key Takeaways
- Use role-based groups so access is assigned and removed consistently.
- Offboarding must revoke sessions, not just disable passwords.
- Preserve mailbox and OneDrive data before removing licenses.
- Automate with HR-driven provisioning and Entra ID lifecycle workflows where available.
- Document every step for audits such as SOC 2 and ISO 27001.
IT Onboarding Checklist
Before day one
- Receive approved start date, role, manager and location from HR.
- Create the Entra ID account with standard naming.
- Assign licenses based on role (see Business Premium vs E3 vs E5).
- Add to role-based security groups, Teams and distribution lists.
- Provision the device with Windows Autopilot or Apple enrollment through Intune.
- Provision access to line-of-business and SaaS apps via single sign-on.
- Issue a Temporary Access Pass for secure first sign-in.
Day one
- Register MFA, ideally phishing-resistant methods.
- Confirm device compliance and encryption.
- Complete security awareness training and acceptable-use acknowledgment.
- Verify access to email, Teams, OneDrive and required apps.
IT Offboarding Checklist
| Step | Action | Timing |
|---|---|---|
| 1 | Disable sign-in and reset password | At exit time |
| 2 | Revoke all sessions and refresh tokens | At exit time |
| 3 | Remove MFA methods and registered devices | At exit time |
| 4 | Wipe or retire company devices; recover hardware | Same day |
| 5 | Convert mailbox to shared or set forwarding/auto-reply per policy | Same day |
| 6 | Transfer OneDrive ownership to the manager | Within retention window |
| 7 | Remove from groups, Teams ownership and app roles | Same day |
| 8 | Revoke SaaS, VPN and third-party app access | Same day |
| 9 | Rotate shared credentials the user knew | Within 24 hours |
| 10 | Remove license after data is preserved | Per retention policy |
Special Cases
- Involuntary terminations: disable access before or during the conversation.
- Administrators: review audit logs and change admin and service account credentials.
- Legal holds: apply litigation hold before removing licenses.
Automate the Lifecycle
HR-driven provisioning and Entra ID Governance lifecycle workflows can create accounts, assign groups and trigger offboarding tasks automatically. Combine with access reviews to catch access that drifts over time.
Preserving data? Read does Microsoft back up Microsoft 365 data before deleting accounts.
How Skytech Enterprise Helps
Our user onboarding and offboarding service handles the full lifecycle with documented, auditable steps, supported by Microsoft 365 tenant management. Contact us.
Frequently Asked Questions
Is disabling an account enough when someone leaves?
No. You should also revoke active sessions and tokens, remove devices and MFA methods, and remove app access to prevent continued use of existing sessions.
What happens to a mailbox when a license is removed?
Removing a license starts a grace period before data is deleted. Convert the mailbox to shared or apply holds first if the data must be kept.
How do we keep a former employee’s OneDrive files?
Configure OneDrive retention for deleted users and grant the manager access so files can be moved before the retention period ends.
Can onboarding be automated in Microsoft 365?
Yes. HR-driven provisioning, dynamic groups, Autopilot and Entra ID lifecycle workflows can automate much of onboarding and offboarding.
Why are offboarding checklists important for compliance?
Auditors check that access is removed promptly when people leave. A documented checklist provides evidence for SOC 2, ISO 27001 and HIPAA.
Who should own offboarding: HR or IT?
HR triggers the process and IT executes the technical steps. Clear handoffs and timelines between both teams are essential.