A 47-point offboarding checklist and the three tiers that decide how fast to run it

This runbook gives a 47-point leaver checklist, the three escalation tiers that set how fast to run it, and the arithmetic that decides when revocation has actually landed. The checklist is a designed method, derived from the control text of ISO/IEC 27001:2022 Annex A 5.11, 5.18 and 6.5 and from current first-party documentation, not from a population of audits. Every timing figure is a documented vendor latency, named where it is used.

Why offboarding fans out

Onboarding grants a known set of access. Offboarding revokes an accumulated set, and the accumulation was rarely recorded at the moment each grant was made. ISO/IEC 27001:2022 splits the obligation across three Annex A controls: A.5.11 return of assets, A.5.18 access rights, which covers removal on termination, and A.6.5 responsibilities that survive employment. One record should satisfy all three.

The diagnostic is cheap. For every leaver in the last 12 months, try to produce a timestamped record of what was revoked, when, by whom and how it was verified. Reading old mail threads for that answer means the process is below audit grade.

Two structural weak points sit outside the item list. The trigger decides whether anything below runs at all: with no authoritative termination event, no item has a start condition. The second is inventory drift, since an offboarding can only revoke access somebody recorded at grant time. A scheduled sweep some days after each leave date covers both, re-checking SaaS status, device return and residual grants.

Prerequisites

• One authoritative termination event. An HR system field, a countersigned form, or a ticket state.
• Microsoft Graph PowerShell, with scopes. Microsoft Learn lists User.RevokeSessions.All, User.ReadWrite.All or Directory.ReadWrite.All for Revoke-MgUserSignInSession. The capture steps also need Directory.Read.All, RoleManagement.Read.Directory and Application.Read.All.
• Exchange Online PowerShell, separately. The mailbox-side disable is a different module and a different connection.
• An asset register keyed on serial number, and an MDM tenant that can still reach the device.
• An evidence location the operator cannot silently edit.
• A mailbox disposition decision taken before the first leaver. Microsoft documents that a converted shared mailbox stays licence-free only below 50 GB, and that a hold on a shared mailbox needs Exchange Online Plan 2, or Plan 1 plus the Archiving add-on.
• A named owner per checklist group. Identity, collaboration, SaaS, devices, compliance and HR rarely sit with one person.

The three tiers and the decision rule

The identity block, as a runnable script

The first eight checklist items in executable form. It captures state before changing it, because the capture is the rollback plan.

# Offboarding, identity block. Microsoft Graph PowerShell v2.
Connect-MgGraph -Scopes 'User.ReadWrite.All','User.RevokeSessions.All',
  'Directory.Read.All','RoleManagement.Read.Directory','Application.Read.All'

$upn  = 'leaver@contoso.com'
$user = Get-MgUser -UserId $upn -Property 'id,displayName,accountEnabled'
$evidence = Join-Path (Join-Path $env:TEMP 'offboarding') $user.Id
New-Item -ItemType Directory -Path $evidence -Force | Out-Null

# 1. Capture. These three files are what a rollback reads from.
Get-MgUserMemberOf -UserId $user.Id -All |
  Select-Object Id, @{n='kind'; e={$_.AdditionalProperties['@odata.type']}},
                    @{n='name'; e={$_.AdditionalProperties['displayName']}} |
  ConvertTo-Json -Depth 5 | Set-Content (Join-Path $evidence 'memberof.json')

Get-MgUserAppRoleAssignment -UserId $user.Id -All |
  Select-Object Id, ResourceDisplayName, AppRoleId, CreatedDateTime |
  ConvertTo-Json -Depth 5 | Set-Content (Join-Path $evidence 'approles.json')

Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance `
  -Filter "principalId eq '$($user.Id)'" |
  ConvertTo-Json -Depth 5 | Set-Content (Join-Path $evidence 'pim-eligible.json')

# 2. Block sign-in, then revoke. Both are Entra critical events.
Update-MgUser -UserId $user.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $user.Id

# 3. Disable on the Exchange side too. This buys the 30 minute figure below;
#    the Graph calls on their own are the 60 minute path.
Connect-ExchangeOnline -ShowBanner:$false
Set-Mailbox -Identity $upn -AccountDisabled:$true

# 4. Verify, and write the verification beside the capture.
Get-MgUser -UserId $user.Id `
  -Property 'accountEnabled,signInSessionsValidFromDateTime' |
  Select-Object AccountEnabled, SignInSessionsValidFromDateTime |
  ConvertTo-Json | Tee-Object (Join-Path $evidence 'verify.json')

Expected output

The verify step prints AccountEnabled as False and SignInSessionsValidFromDateTime as a UTC timestamp within seconds of the run. Microsoft describes that property as the marker the revocation call resets to the current time, invalidating issued refresh tokens and browser session cookies. Four files land in the evidence folder: memberof, approles, pim-eligible and verify.

The output does not mean access has stopped everywhere. Microsoft states that terminating an email session takes effect within about 30 minutes when the account is disabled in the Exchange admin center or Exchange Online PowerShell, about 60 minutes through the Microsoft Entra admin center, and three hours or more when the change starts on-premises. Separately, a default access token is valid for one hour, and where client and resource have both negotiated Continuous Access Evaluation the lifetime extends to as much as 28 hours. CAE offsets that by subscribing services to critical events, which include an account being disabled and an administrator revoking refresh tokens, with a documented target of near real time and observed latency of up to 15 minutes.

Compute your own revocation window

Derive the target from three inputs you can read out of your own tenant.

• A, the human interval: minutes from the termination decision to the operator starting the script. Take this from ticket timestamps.
• B, the Exchange session-termination delay: 30 minutes when the disable runs in Exchange Online PowerShell or the Exchange admin center, 60 when it runs only through the Entra admin center, 180 or more if the authoritative account lives on-premises. Microsoft publishes this figure for email sessions. Every non-Microsoft service in scope needs its own published figure, or B is unknown for it.
• C, the token residual: 60 minutes for non-CAE clients, up to 15 minutes for a CAE-capable client and resource pair on a critical event, and up to 28 hours for a CAE session where the critical-event path is not reaching the resource.

The worst-case window is A plus the larger of B and C. A tier 2 promise of full revocation inside 30 minutes is unachievable on a non-CAE estate, because C alone is 60; it becomes achievable once the estate is CAE-capable throughout and A is small. Compute the tier target from that arithmetic. The offboarding risk assessment is a separate instrument: ten questions scoring the surrounding process across access control, evidence and post-departure monitoring.

The 47 points

Identity, 01 to 08

• 01. Block sign-in. Do not delete: a deleted account is recoverable for roughly 30 days, and deletion breaks any shared mailbox or forwarding anchored to it.
• 02. Revoke refresh tokens and session cookies.
• 03. Reset the password to a random value, generated then discarded, so an accidental re-enable restores nothing.
• 04. Remove registered MFA methods and unused recovery codes.
• 05. Snapshot group memberships, then remove them. Check for dynamic-rule membership, which re-adds the user until the attribute changes.
• 06. Remove active directory-role assignments and PIM-eligible schedules. They are separate objects, and an activated assignment runs to the end of its window unless deactivated.
• 07. Remove the account from every Conditional Access exclusion group.
• 08. Rotate credentials on shared and service accounts the leaver held. Issue a new secret; a re-authentication prompt leaves the old one valid.

Email and collaboration, 09 to 15

• 09. Decide mailbox disposition: convert to shared, licence-free below 50 GB, or keep it licensed under hold.
• 10. Remove inbox rules, mailbox forwarding and transport rules referencing the leaver.
• 11. Enumerate and reassign delegate, full-access and send-as permissions the leaver held elsewhere.
• 12. Apply the eDiscovery or litigation hold before the licence is removed, never after.
• 13. Transfer OneDrive ownership and record who received it.
• 14. Reassign SharePoint sites where the leaver was the only owner.
• 15. Transfer team and group ownership, then remove membership explicitly. Blocking sign-in stops authentication; it leaves the user on the group object.

SaaS and developer access, 16 to 22

• 16. Trigger SCIM deprovisioning and read every result. A SCIM call can fail without surfacing an error to the admin.
• 17. Deactivate non-SCIM SaaS accounts from the assignment register, one by one.
• 18. Revoke OAuth grants and consented application permissions. Where a provider exposes an RFC 7009 revocation endpoint, use it; the RFC itself notes that propagation delay leaves some servers honouring a revoked grant.
• 19. Invalidate API tokens and personal access tokens the leaver generated.
• 20. Remove SSH public keys at the platform and from every deployed authorized_keys file.
• 21. Remove cloud IAM principals and role assignments at the provider as well as at the identity provider.
• 22. Remove repository access at organisation, team and per-repository collaborator level.

Devices and physical, 23 to 30

• 23. Choose the correct MDM action. Microsoft defines wipe as a factory reset removing all data and settings, and retire as removal of company data while personal data stays intact. Corporate-owned takes wipe; personally owned takes retire.
• 24. Before retiring an Entra-joined device, capture the BitLocker recovery key and local administrator credentials. Microsoft documents that retiring or deleting the Intune object removes key protectors and suspends BitLocker on the OS volume.
• 25. Issue the return workflow with a stated window and a prepaid label.
• 26. Confirm physical receipt against the serial number in the asset register.
• 27. Sanitize to a named NIST SP 800-88 category. Purge defeats laboratory recovery while keeping the device reusable, and cryptographic erase is the purge technique for self-encrypting drives and BitLocker or FileVault volumes. On flash media, wear levelling stops a multi-pass overwrite reaching every cell.
• 28. Record the disposition: redeployed, or routed to WEEE-compliant recycling.
• 29. Deactivate badge and key-fob credentials and retrieve the card.
• 30. Update the reception and visitor-desk authorisation list.

Communication and data, 31 to 36

• 31. Remove the person from the org chart, intranet pages and internal directory.
• 32. Reassign the phone extension and any on-call rota entry.
• 33. Update CRM record ownership and customer-facing contact listings.
• 34. Notify vendors where the leaver was the named contact, and supply the replacement.
• 35. Update external bios, speaker listings and company social accounts.
• 36. Set an out-of-office on the converted mailbox naming the successor.

Compliance and legal, 37 to 42

• 37. Issue the post-termination obligations letter, the artefact ISO/IEC 27001:2022 A.6.5 asks for.
• 38. Verify work product sits in corporate-controlled storage, and remediate copies held in personal accounts.
• 39. Apply the retention label set governing departed-employee content.
• 40. Check for active litigation or regulatory holds before any deletion step runs.
• 41. Update the register of authorised persons. Under Regulation (EU) 2016/679 an employee is a person acting under the authority of the controller, addressed by Article 29, and is not a processor as defined in Article 4(8). The Article 30 record covers processing activities, so it changes only if the departure changes an activity.
• 42. File the completion record as the evidence for A.5.11 and A.5.18.

Financial and HR, 43 to 47

• 43. Revoke expense-system access while preserving submission history.
• 44. Cancel the corporate card and reconcile outstanding charges with finance.
• 45. Close payroll, notify benefits continuation, schedule statutory forms.
• 46. Move the HRIS record to former-employee status, which is what downstream retention automation reads.
• 47. Take three-way sign-off from HR, IT and the line manager, stored with the record.

Side effects

• Removing the licence without a hold already in place starts a 30-day clock. Microsoft documents that mail, contacts and calendar are retained for 30 days after a licence is removed or deleted, then permanently deleted. The hold has to exist first: a hold plus deletion of the account is what creates an inactive mailbox, and the licence frees up once the account is gone.
• Forwarding to a personal address fails silently, by default. Outbound spam policy in Exchange Online blocks automatic external forwarding, and the value labelled Automatic, system-controlled now behaves the same as off.
• Deleting the account breaks the shared mailbox, which needs the disabled account as an anchor.
• Retire suspends BitLocker on the OS volume. Capture the recovery key first.
• Wipe is not reversible. A wiped device offers no rollback for data that was only ever local.
• Removing memberships can orphan a team or a site. Run the ownership transfers, items 13 to 15, before the membership removal in item 05.

Rollback

Garden leave, a rescinded resignation and a wrongly triggered workflow need the same reversal, and it exists only if the capture ran.

• Re-enable with Update-MgUser -AccountEnabled:$true and Set-Mailbox -AccountDisabled:$false, then have the person register fresh MFA methods.
• Restore memberships from memberof.json and application assignments from approles.json. Skip entries whose kind indicates a dynamic group; those return on their own.
• Recreate PIM eligibility from pim-eligible.json. Re-enabling the account does not restore it.
• Reassign the licence, then re-apply the hold, in that order.
• If the account was deleted, restore it inside the roughly 30-day window Microsoft documents.
• Devices need re-enrolment. A retired device re-enrols with its data intact; a wiped one does not.
• Rotated shared-account credentials stay rotated. Issue new ones.

Limitations

Every latency figure here is Microsoft documentation for Microsoft 365 and Microsoft Entra ID. On Google Workspace, Okta or a self-hosted identity provider the propagation numbers, token behaviour and recovery windows differ, and the tier targets have to be recomputed against that vendor's published figures. The script assumes cloud-only or cloud-authoritative accounts; where an on-premises directory is authoritative, the change must be made there as well or Entra Connect will overwrite it.

The checklist assumes a corporate-owned device estate under MDM, a single identity provider of record, and an HR system that emits a termination event. A fully personally-owned estate loses items 23, 26, 27 and 28. Contractors, service accounts owned by the leaver and guest identities need their own pass. The 47 items are a designed superset: parts will be dead weight at 15 people and insufficient for a regulated entity with sector-specific retention duties. References to Regulation (EU) 2016/679 and ISO/IEC 27001:2022 Annex A locate the obligation and are not legal advice; the standard is paywalled, so the control text has to be bought and read against an actual scope statement. Nothing here is evidence of a certification. If the M365 side needs an owner, that is the Microsoft 365 management service.

Last verified 2026-07-28. Checked against Microsoft Learn: cmdlet names and permissions; session-termination latency and the 30-day post-licence retention in the remove-a-former-employee series, steps 6 and 7; hold and licence ordering in the Purview inactive-mailbox article; token lifetime and critical events in the Continuous Access Evaluation article; wipe and retire in the Intune device action reference. Sanitization categories against NIST SP 800-88 Rev. 2, September 2025.