Guide
Automating Microsoft 365 arrivals and departures: an MSP’s checklist
A clean Microsoft 365 offboarding takes nine steps: block sign-in, revoke sessions, reset the password, review MFA, decide on the mailbox, remove licences, give access to OneDrive, handle devices and keep the proof. OKTO PSA blocks, re-checks and traces it all in the ticket.
This guide cites Microsoft Learn documentation and says plainly what the software handles and what stays with your technician.
What are the steps of a clean Microsoft 365 offboarding?
Nine steps, in this order: cut access first, decide what happens to the content next, clean up licences and devices last, and keep proof of every action. Order matters, because an account that stays active while people discuss the mailbox is still an open account.
The basic rule: block sign-in and revoke sessions within minutes of the departure time, then handle the mailbox, OneDrive, licences and devices with the client’s agreement.
Block sign-in
Disable the account in Entra ID. The user can no longer start a new session. Do not delete anything at this stage.
Revoke sessions
Use “Revoke sessions” on the user’s page. Microsoft notes that access tokens last one hour by default, so the user may keep partial access until they expire, depending on the application.
Reset the password
Set a random password nobody knows. In a hybrid environment, Microsoft recommends doing it twice in Active Directory to limit the risk caused by replication delays.
Review MFA
Remove or note the registered authentication methods (phone, app). This is good practice rather than a requirement: it keeps a personal phone from staying tied to the account.
Shared mailbox or forwarding
If customers still write to this address, convert the mailbox to a shared mailbox or forward the email to the successor. That is the client’s decision, not yours.
Licences
Remove the licence once the content is secured. According to Microsoft, email, contacts and calendar are kept for 30 days after removal, then permanently deleted.
OneDrive
Give a manager access before deleting the account. After an account is deleted, OneDrive and Outlook content is kept for 30 days.
Devices
Disable the devices registered to the user and wipe company data from the phone or tablet. The wipe only takes effect when the device connects to the internet.
Keep the proof
Record who asked, who approved, the time of the block and the result of each check. That is what a client or an auditor will ask for.
What should you plan for an arrival?
An arrival is prepared before day one. Most of the time, what delays a new hire is not creating the account but a detail that was missing from the request.
Account and email
Legal name, preferred address, start date. A typo in the name becomes an address to fix later.
The right licence
The role decides the licence: an office worker, a field worker and a manager do not need the same thing.
MFA from day one
Multifactor registration happens on the first day, with the technician or the manager, not “later”.
Groups and shared mailboxes
Team, shared folders, common mailboxes. The manager knows what the person should be able to reach.
Computer and phone
Device ready, updates done, software installed before handover. A wait on the first morning costs the client.
Password handover
Never in plain email. A one-time link or an in-person handover is better.
Who asks for what, and how fast?
The client asks, you execute. The timelines below are suggestions to write into your service agreement, not Microsoft requirements.
| Step | Who decides | Suggested timeline | Proof to keep |
|---|---|---|---|
| Arrival | Client’s manager | Request received 2 business days before the start | Written request, licence assigned, MFA registered |
| Block at departure | Manager or HR | At departure time, or within the hour after notice | Time of the block, who requested it |
| Mailbox | Manager | Decided before the licence is removed | Forwarding or shared mailbox, recipient’s name |
| OneDrive | Manager | Access given before the account is deleted | Name of the person who got access |
| Devices | Client and technician | Collected within the week | Devices returned, wipe confirmed |
For what to keep and for how long, see also the Law 25 guide for IT service providers.
How does OKTO PSA help you follow this list?
It takes care of the block, the check and the trace. The other steps stay with your technician, in the ticket. We would rather say it plainly than let you think software replaces the checklist.
Start from a ticket or the portal
The technician starts the arrival or departure from the ticket. The client can also request it in their portal, and cancel a planned departure.
Block, never delete
At departure, the account is blocked and kept. That gives you time to decide about the mailbox and the files.
Re-check
Fifteen minutes after the departure, OKTO PSA checks again, then at 1 hour and 4 hours if the block did not hold. A notice warns you on failure.
Arrival password
An encrypted secret note, readable once, lets you pass the password along without putting it in an email.
Offered on request
Microsoft 365 arrivals and departures rely on an engine that is not included by default: it is offered to IT providers, on request. A scheduled automatic departure exists, off by default. Details on the Microsoft 365 and Teams for MSPs page.
What proof should you keep for an audit or a dispute?
Keep what answers four questions: who asked, who approved, when it happened, and whether it worked. The ticket file carries all four answers in one thread if you note each step there.
- The client’s request, with the name of the person who made it and the date.
- The time of the block, and of each re-check.
- The mailbox decision (shared mailbox, forwarding, none) and the recipient’s name.
- The licences removed and the date, since the content disappears 30 days later.
- The devices collected or wiped.
Sources
- Revoke user access in an emergency in Microsoft Entra ID (Microsoft Learn), accessed October 27, 2026.
- Remove a former employee (Microsoft Learn), accessed October 27, 2026.
Frequent questions
The questions we get asked
Your question is not here?
Write to us. A person in Trois-Rivières answers, within one business day.
Ask your questionBlock sign-in by disabling the account in Entra ID, then revoke sessions. Do not delete anything at that point: the content stays recoverable.
Microsoft states that access tokens last one hour by default, so access may last until they expire, depending on the application. Revoking sessions shortens that window.
According to Microsoft, email, contacts and calendar are kept for 30 days after the licence is removed, then permanently deleted. Convert the mailbox to a shared mailbox or forward it first.
The client, through a manager or HR. They know the date and decide what happens to the mailbox and files. The IT provider executes and keeps the proof.
No. It blocks the account, re-checks it at 15 minutes, 1 hour and 4 hours, and traces everything in the ticket. Licences, OneDrive and devices remain steps for your technician.
Not by default. It is offered to IT providers, on request.
Put this checklist in your tickets
Tell us about your monthly departures. We will show you the path in the demo, from the client’s portal to the ticket.
OKTO Solutions, Trois-Rivières, Quebec