The offboarding runbook and the MTTFAR clock
Offboarding is a race against the access a leaver still holds. This is the order of operations I run and the mean-time-to-full-access-revocation targets I hold each departure to, from a standard leaver to a hostile termination.
Offboarding has a clock on it. The measure I care about is mean time to full access revocation, the gap between the termination decision and the moment the person can no longer reach anything. This runbook sets the order of operations and the target time per departure risk.
Last verified: 2026-08-03.
Prerequisites
- The trigger: an HRIS termination date, or a manager authorisation for an unplanned exit.
- Read and write access to Entra, the mailbox, Intune, and the SaaS that matter.
- An evidence store to timestamp each step.
Order of operations
- Disable the primary identity and record the state change.
- Revoke active sessions (Graph revokeSignInSessions) so existing tokens die.
- Remove admin and privileged roles, including PIM eligible assignments.
- Review and revoke delegated OAuth grants for that user.
- Reclaim the licence and convert the mailbox to shared, after reviewing forwarding rules.
- Wipe or retire the managed devices.
- Transfer mailbox and drive ownership to the manager or successor.
- Turn on a post-departure sign-in alert and schedule a 30-day straggler sweep.
Expected output
# The revocation-time target per departure risk (MTTFAR)
standard departure : under 24 hours from final working time
sensitive departure : under 60 minutes from HR/manager authorisation
hostile departure : under 15 minutes from the termination conversation start
Standard covers a planned exit. Sensitive covers a privileged user, a competitor move, or sensitive-data access. Hostile covers a termination for cause, an investigation, or a legal hold. The tool that scores readiness for each is at /tools/offboarding-risk.
Side effects
Revoking sessions and disabling the account will drop the person mid-task, which is the point on a hostile exit and a courtesy risk on a friendly one, so sequence the manager handover first when the exit is amicable. Converting a mailbox to shared preserves access for the team while removing the sign-in.
Rollback
Most steps are reversible for a set window: a disabled account can be re-enabled, a shared mailbox reverted, a licence reassigned. A device wipe is not reversible, so it goes last and only after the data transfer is confirmed. Keep the evidence record so a re-instatement is exact.
Limitations
The targets above are the ITSailor targets I hold departures to, not an external standard. The runbook covers Microsoft 365 and Entra as the core; developer platforms and non-Entra SaaS need their own deprovision step. Hitting the target is evidence the access was cut in time, not proof that nothing was taken before the trigger.
Offboarding Evidence cannot certify that the target was met. What its recurring read records is the date a residue was still present and the first later read on which it was gone, which bounds this clock from both sides, from Offboarding Evidence.
Sources and further reading
Turn the procedure into a tenant decision.
The Architecture Workshop maps the checks, side effects, and rollback path to your own Microsoft 365 environment.
Review the workshopMore from Ops Log
The Google Workspace scope for reading a leaver's app grants is not read-only
Listing a Google Workspace user's third-party app tokens needs admin.directory.user.security, the same scope that deletes them, and Google lists no read-only variant. Microsoft Graph lists the equivalent grants with Directory.Read.All. Treat the Google credential as a revocation key.
A daily offboarding check can prove closure only as a bound
A leaver check that runs once a day can report closure only as a bound between two runs. A Graph 429, including one inside a batch that returns 200, and a membership read that returns nulls can each make a degraded run look clean, so an absence counts only from a run that read cleanly.
A Purview hold does not stop an unpaid OneDrive being deleted at day 365
Since 1 July 2026 an unlicensed OneDrive that is neither relicensed nor covered by unlicensed-account billing is subject to deletion after 365 cumulative unpaid days, whatever Purview retention or hold sits on it, and it drops out of eDiscovery at day 275. This note gives the read-only check.