When an employee or contractor leaves a client organisation, the MSP must coordinate access removal, device custody, business data handover and continuing service responsibilities. An HR notification is an instruction to begin the process, not evidence that every technical identity has been disabled. A disabled main account may still leave active sessions, delegated mailbox access, third-party service credentials or a device containing customer information. Equally, deleting accounts too early can destroy records and disrupt a lawful business handover.
Reliable offboarding starts with an authorised departure record and ends with independently checked results for the systems actually in use. The sequence depends on the client's employment decision, operational risk and retention requirements. The MSP must not independently determine an employee's employment status, disclose personnel details beyond the approved need or assume that a successful automation run covers all applications. A useful plan distinguishes actions that remove access, actions that transfer legitimate work and evidence proving those actions occurred.
Confirm the authorised departure event and timing
Obtain a named business approver, verified identity, effective departure time and clear instruction for the relevant country or working time zone. Distinguish a normal resignation, change of role, contract expiry and immediate access restriction; they do not necessarily require identical timing or communications. Record who authorised the action and which team can approve an exception. An MSP technician should not improvise a departure date from a calendar invite or informal chat message.
Plan actions that must happen before, at and after departure. Some information handovers can be prepared in advance without exposing the departing worker's private data or prematurely blocking legitimate work. Others, such as session revocation, must align with the approved cut-off. Keep an explicit status for pending approval, scheduled action, executed action and independently verified completion. The difference matters because scheduling is not execution and execution is not the same as successful removal in every target system.
Build an inventory of access, devices and dependencies
Map the employee to primary directory accounts, cloud services, VPN, managed devices, shared mailboxes, third-party portals, specialist line-of-business systems and privileged roles. Include delegated access, service ownership, API tokens and accounts that might not be associated with the main directory. A departmental application can remain active after the Microsoft account is blocked if its supplier manages a separate identity. This must be tested against the real application list rather than guessed from an integration dashboard.
Find business dependencies that would be affected by indiscriminate deletion: scheduled reports, customer correspondence, approved automations and a shared administrative function. Separate personal authentication credentials from business-owned service identities and authorised team access. A departing staff member's password must not be reused to maintain a service. Where a process relies on an individual, replace its ownership through an approved route and test continuity before disposing of old entitlements.
Remove effective access without losing legitimate records
Use an authorised workflow to block or remove sign-in at the right time, revoke sessions where supported, disable remote access and remove group memberships or privileged assignments no longer justified. Do not assume that disabling one directory account terminates every existing application session or token. UK NCSC guidance on identity and access management explains the lifecycle and least-privilege principles relevant to joiners, movers and leavers.
Check the target systems for actual results and record any exceptions. An on-premises directory, cloud identity, VPN and separately managed supplier service may update at different times. A failed connector should create an owned exception, not a false completion message. If an account is retained for records, restrict and document the resulting access and handling rather than leaving active credentials in place.
Microsoft's lifecycle workflows documentation describes configurable leaver tasks, while Microsoft's revoke-access guidance explains additional identity and session considerations. These are examples for supported Microsoft environments, not proof that unrelated third-party services are covered. Verify implementation against the client's actual tenant and application inventory.
Protect shared information and continuity of customer work
Identify business documents, active support cases, ownership of project tasks, scheduled customer meetings and messages requiring an authorised covering colleague. Work-related records must remain accessible only to people with a legitimate role and within the client's retention policy. Transferring a mailbox or cloud storage owner does not justify broad disclosure of irrelevant private material. The organisation's policy and applicable law determine the correct review and retention route.
Record which replacement colleague is accountable for each outstanding action. A ticket awaiting a supplier response may need its case owner changed without altering the underlying evidence. A customer appointment may need an authorised reschedule with accurate notice, not an automatic claim that a new employee will attend. Preserve audit history when responsibilities change; deleting the previous owner's identity from past decisions can undermine traceability.
Where customer personal information is involved, apply access minimisation and retention safeguards. ICO data-minimisation guidance is relevant to deciding what information should be transferred or retained. It does not authorise a blanket export of every folder or conversation merely because the employee is departing.
Recover equipment and confirm actual physical custody
Prepare a return list using actual asset records: laptop, phone, security token, storage device, specialist equipment, accessories and any client property held off-site. Include serials or tags and the responsible return contact. A courier label being generated does not prove the equipment has been collected; a scan at a depot does not prove that the MSP has inspected the correct device. Track physical custody until accepted and reconciled.
Where the organisation owns the equipment, choose approved reset, remote wipe or quarantine steps according to data retention needs and device state. Do not wipe a device in a manner that destroys information subject to a lawful preservation instruction. A remote management command may remain pending while a device is offline; its issuance is not proof of completed sanitisation. Record the command result and physical inspection separately.
For a device being reissued, verify identity removal, data sanitisation, device-management enrolment, security configuration and working condition before treating it as a ready spare. A recovered laptop with unresolved access or data-handling issues should remain in a controlled state, not automatically return to saleable or issueable stock.
Handle privileged accounts, secrets and service dependencies
Privileged and supplier-facing access warrants a focused check. Review administrative roles, VPN exceptions, remote management portals, delegated application credentials and saved secrets. If the departing employee knew a shared secret that cannot be attributed to individual identities, arrange a controlled credential rotation and dependent-service test. Do not publish a new secret inside a support ticket or ordinary email as a shortcut.
Record who owns service accounts and scheduled automations after the departure. Some jobs may have been created by a personal user identity and require authorised reconfiguration. Distinguish removing personal access from changing the service principal or owner. A rushed deletion may stop legitimate billing, monitoring or reporting. Complete a documented handover and functional test for business-critical jobs before marking continuity arrangements closed.
Escalate ambiguous permissions to a qualified identity or application owner. A list of group names does not always reveal effective access from nested membership or application-local roles. The aim is to confirm the real ability to authenticate and perform sensitive tasks, not merely to produce a green status on a central checklist.
Verify the departure outcome across independent systems
After the approved cut-off, check the authoritative identity platform, remote-access system and key business applications. Confirm that sign-in is blocked or access removed in the intended scope, while authorised shared business records remain available to appropriate staff. Record the test result, time, responsible reviewer and unresolved exceptions. Where a supplier portal cannot be checked directly, retain the supplier case reference and identify the person responsible for confirmation.
Check that the employee's accounts are not accidentally recreated by a delayed provisioning feed, that long-lived sessions were handled under relevant platform controls and that notifications or meetings have been reassigned appropriately. Reconcile equipment receipts to the asset register. Do not call a generated cancellation email evidence of completed account disablement or device recovery.
Where the organisation retains a limited account or archive for a lawful reason, document the purpose, restrictions, review owner and later disposal decision. A retention decision is separate from permitting the former user to authenticate. Be explicit about what is complete and what requires another person or supplier to finish.
Improve the next offboarding through exception evidence
Review repeated failures: missing supplier application ownership, unclear approval times, unmanaged devices, shared credentials, inaccessible historic records or delayed automation. Each failure should lead to a specific register, process or configuration correction, not a generic claim that all future offboarding is automated. Compare actual exceptions and the time to resolution across equivalent cases; do not invent a universal percentage benefit.
Keep offboarding coordinated with onboarding and role changes. The same access register that determines a new colleague's approved rights should identify what must end when a person leaves or changes work. The MSP provides the technical evidence and operational controls; the client remains responsible for the underlying business authorisation. Completion means the material risks and continuity needs have been checked, not simply that a task list has been ticked.
Primary sources: UK NCSC, Introduction to identity and access management; Microsoft Learn, Lifecycle workflows; Microsoft Learn, Revoke user access; ICO, Data minimisation. These explain principles and platform operations, not an independent guarantee that any particular client's offboarding has finished.
Leaver offboarding: which access-control step proves completion?
Disabling a worker's main identity is an important control but does not prove that existing sessions, external supplier accounts, company equipment and service dependencies have been addressed. The correct action depends on the employer's authorised instruction, the application and whether business records need a legitimate new owner. These five controls should be verified independently rather than combined into a single tick.
| Control | Intended outcome | Separate verification needed |
|---|---|---|
| Disable primary sign-in | Prevent future authentication through the identity provider where supported. | Existing sessions, linked apps, emergency accounts and other identities. |
| Revoke supported sessions | Invalidate relevant refresh tokens or sessions under platform rules. | Application-specific session lifetime and independent supplier portals. |
| Transfer business ownership | Maintain approved access to legitimate documents, workflows and reports. | Authorised recipient, privacy, retention and scheduled-job dependencies. |
| Recover managed equipment | Establish physical custody of laptops, phones and tokens. | Confirmed receipt, asset register, authorised sanitisation and disposal. |
| Remove vendor access | Revoke separately managed rights at suppliers or customers. | Provider acknowledgement and actual entitlement removal. |
Practical decision: Start with the authorised employee identity, exact effective time and approved action. Record a distinct result for each relevant platform and supplier. For a sudden departure, follow the preapproved urgent security route while ensuring business-data retention decisions are made by the appropriate owner. Never preserve unrestricted interactive access just because an old scheduled job depends on a personal account; identify a supported service-ownership remedy.
Source A: UK NCSC, Introduction to identity and access management explains access lifecycle and privilege principles, not the employer's employment decision. Source B: Microsoft Learn, Revoke user access documents platform-specific revocation behaviour and its limits. Image source: the article's role-based access control diagram by Babbage (CC0 1.0) is directly related to permissions and role reassignment; it illustrates a model rather than an actual company directory.
Frequently asked questions
Is disabling the primary employee account enough?
No. Check sessions, connected services, administrative privileges, supplier accounts and any separately managed access routes within the approved offboarding scope.
Should all leaver data and mail be deleted immediately?
Not automatically. The authorised business owner must determine legitimate retention, transfer and deletion under applicable policies and law. Use approved procedures and limit access.
What happens if scheduled integrations use the employee's account?
Identify the dependency and transfer ownership or credentials through authorised means. Preserve business continuity without leaving unrestricted personal access active indefinitely.
How should a remote employee return a laptop?
Use a controlled collection or shipping arrangement, record asset identity and receipt, then apply the organisation's device security and sanitisation process.
When may an MSP close an offboarding ticket?
When authorised controls are executed and appropriately verified, with outstanding external access, device or data tasks assigned and disclosed to the responsible client owner.