The offboarding runbook and the MTTFAR clock
Offboarding is a race against the access a leaver still holds. This is the order of operations I run and the mean-time-to-full-access-revocation targets I hold each departure to, from a standard leaver to a hostile termination.
Offboarding has a clock on it. The measure I care about is mean time to full access revocation, the gap between the termination decision and the moment the person can no longer reach anything. This runbook sets the order of operations and the target time per departure risk.
Last verified: 2026-08-03.
Prerequisites
- The trigger: an HRIS termination date, or a manager authorisation for an unplanned exit.
- Read and write access to Entra, the mailbox, Intune, and the SaaS that matter.
- An evidence store to timestamp each step.
Order of operations
- Disable the primary identity and record the state change.
- Revoke active sessions (Graph revokeSignInSessions) so existing tokens die.
- Remove admin and privileged roles, including PIM eligible assignments.
- Review and revoke delegated OAuth grants for that user.
- Reclaim the licence and convert the mailbox to shared, after reviewing forwarding rules.
- Wipe or retire the managed devices.
- Transfer mailbox and drive ownership to the manager or successor.
- Turn on a post-departure sign-in alert and schedule a 30-day straggler sweep.
Expected output
# The revocation-time target per departure risk (MTTFAR)
standard departure : under 24 hours from final working time
sensitive departure : under 60 minutes from HR/manager authorisation
hostile departure : under 15 minutes from the termination conversation start
Standard covers a planned exit. Sensitive covers a privileged user, a competitor move, or sensitive-data access. Hostile covers a termination for cause, an investigation, or a legal hold. The tool that scores readiness for each is at /tools/offboarding-risk.
Side effects
Revoking sessions and disabling the account will drop the person mid-task, which is the point on a hostile exit and a courtesy risk on a friendly one, so sequence the manager handover first when the exit is amicable. Converting a mailbox to shared preserves access for the team while removing the sign-in.
Rollback
Most steps are reversible for a set window: a disabled account can be re-enabled, a shared mailbox reverted, a licence reassigned. A device wipe is not reversible, so it goes last and only after the data transfer is confirmed. Keep the evidence record so a re-instatement is exact.
Limitations
The targets above are the ITSailor targets I hold departures to, not an external standard. The runbook covers Microsoft 365 and Entra as the core; developer platforms and non-Entra SaaS need their own deprovision step. Hitting the target is evidence the access was cut in time, not proof that nothing was taken before the trigger.
Sources and further reading
Turn the procedure into a tenant decision.
The Architecture Workshop maps the checks, side effects, and rollback path to your own Microsoft 365 environment.
Review the workshopMore from Ops Log
Mailbox forwarding rules survive the leaver: the offboarding check most runbooks skip
An enabled inbox forwarding or redirect rule keeps sending a departed employee mail long after the account is disabled. Here is how to find every one from Microsoft Graph and shut it before it becomes an exfiltration path.
The offboarding evidence pack, control by control
An auditor does not ask whether an offboarding SOP exists. They ask for the artifact that proves each control ran. Here are the twelve controls I build the evidence pack around and the proof each one needs.
What a Microsoft 365 offboarding scan finds after the account is disabled
Disabling an Entra account is the start of offboarding, not the end. Here are the eight access residues a read-only Microsoft Graph scan reads back, and why each one matters to an auditor.