Free tool · Works with Microsoft 365

Offboarding Runbook and Leaver Check

Build a leaver runbook for Microsoft 365: what to do before, at and after the last day, with the command, the check and the evidence for each step. Then, if you want, check one tenant read-only for what leavers still hold.

AssertedEvery cmdlet was read on Microsoft Learn on 18 October 2026, and each step links the page it came from.
AssertedThe builder runs in your browser. Nothing you type is sent, and there is no account or email.
CommittedThe tenant check is optional and read-only. A result is held for ten minutes, then deleted.

Build the runbook Go to the leaver check

Before you start

You give: The departure type and a few facts about your estate. The leaver check, if you want it, asks for one read-only Global Reader sign-in.
It reads: What you type, in this browser. The leaver check reads accounts, licences and sign-in dates from your tenant, read-only. The exact permissions.
It keeps: Nothing from the builder. A leaver check result is held for ten minutes, then deleted.
Who sees the result: Only you. There is no email field on this page.
Why it is free: Free because these checks show how I work. If a result needs fixing, I scope that as a fixed-scope job.

Build the runbook

Choose the type of departure and how your estate is set up. The runbook below updates as you go: each step has the reason, the commands, how to check it worked and what to keep.

Nothing you type here leaves this tab, and there is no account or email. The site counts, with no identifier, how many people start and export a runbook: the tool name, the hour and the referring site, never your answers.

Type of departure

StandardPlanned departure, normal working relationship.Block sign-in when the last working time ends.SensitivePrivileged, finance or admin access, or a move to a competitor.Block sign-in as soon as the departure is authorised, and no later than the last working time.Hostile or dismissalImmediate exit, for cause, or under investigation.Block sign-in at the start of the exit meeting, before the person is told.

Where the accounts live

Cloud onlyAccounts are created in Microsoft Entra ID.HybridAccounts are synced from Active Directory by Microsoft Entra Connect.

Devices and mail

Laptops and phones are enrolled in Microsoft IntuneKeep the mailbox for the team as a shared mailbox

Other SaaS the leaver used

Names only. They become a checklist in the runbook and are never put into a command.

Optional: fill the commands in

Leaver's sign-in nameUsed in the commands only if it is a plain address, such as jan@contoso.com.Manager or receiver's sign-in nameGets the mailbox and files in the handover steps.

Optional readiness checksix questions, no score

Your runbook

Standard departure, cloud accounts

Block sign-in when the last working time ends. Devices are in Intune. The mailbox becomes a shared mailbox.

Every cmdlet and parameter was read on Microsoft Learn on 18 October 2026, and each step links the page. ITSailor did not run them against your tenant. Review before running. Test on a test account first. The order and the three departure types are my recommendation; the commands are Microsoft's.

22 rows in the record. 0 done, 0 verified.

The record lives in this tab only. Download it before you close the page.

PrepareBefore the last day

1. Connect and name the leaver and the manager
Every later command reads the same variables, so one typo in one place cannot point a step at the wrong account.
- Sign in with an administrator account, not the leaver and not your daily account.
- The two addresses below are the only things you edit. Leave the placeholders and every command fails instead of hitting a wrong account.
Review before running. Test on a test account first. PowerShell
```
Start-Transcript -Path ".\leaver-transcript.txt" -Append
```
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "User.Read.All"
$upn = '<leaver-upn>'
$manager = '<manager-upn>'
$user = Get-MgUser -UserId $upn -Property Id,DisplayName,UserPrincipalName,AccountEnabled
$managerUser = Get-MgUser -UserId $manager -Property Id,DisplayName,UserPrincipalName
$userId = $user.Id
$managerId = $managerUser.Id
$user | Format-List DisplayName,UserPrincipalName,AccountEnabled
```
Review before running. Test on a test account first. Exchange Online PowerShell
```
Connect-ExchangeOnline
```
Check it worked
The output shows the leaver's name and address, and AccountEnabled is True before you start.
Keep as evidence
The first lines of the transcript file, which carry the date, the account you used and the leaver.
Read on Microsoft Learn: Start-Transcript
Record the evidence for this step
Evidence for Connect and name the leaver and the manager
DoneVerified
Done byWhenNote
2. Record what the account holds today
A before picture is what gives the after picture its meaning, and it is the proof that nothing was missed.
- Uses $upn, $userId, $manager and $managerId from the Prepare step.
- Every line below only reads. Nothing changes until the exit steps.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "User.Read.All","Directory.Read.All","RoleManagement.Read.Directory"
Get-MgUserLicenseDetail -UserId $userId | Select-Object SkuPartNumber,SkuId
Get-MgUserMemberOfAsGroup -UserId $userId -All | Select-Object Id,DisplayName
Get-MgUserOwnedObject -UserId $userId -All
Get-MgUserOauth2PermissionGrant -UserId $userId -All
Get-MgUserAppRoleAssignment -UserId $userId -All | Select-Object ResourceDisplayName,AppRoleId
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$userId'"
Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -Filter "principalId eq '$userId'"
Get-MgUserRegisteredDevice -UserId $userId -All
```
Review before running. Test on a test account first. Exchange Online PowerShell
```
Get-Mailbox $upn | Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward,LitigationHoldEnabled
Get-MailboxStatistics -Identity $upn | Format-List TotalItemSize,TotalDeletedItemSize
Get-MobileDevice -Mailbox $upn
```
Check it worked
You have a saved list of licences, groups, owned objects, consent grants, app roles, roles, devices and the mailbox settings. You will compare it with the same listing at T+30 days.
Keep as evidence
The transcript, or the lists saved to files named with the leaver and the date.
Read on Microsoft Learn: Get started with the Microsoft Graph PowerShell SDK
Record the evidence for this step
Evidence for Record what the account holds today
DoneVerified
Done byWhenNote
3. Agree the handover with the manager
Access can only be handed over safely once a named person has agreed to receive it.
- Name the person who takes the mailbox and the OneDrive files.
- From the inventory, list the teams, groups and apps the leaver owns and who takes each one.
- Tell HR and the manager when sign-in will be blocked, unless the departure is hostile.
Check it worked
A named person is recorded for the mailbox, the files, and each owned object.
Keep as evidence
The handover note with names and the date.
Read on Microsoft Learn: Remove a former employee
Record the evidence for this step
Evidence for Agree the handover with the manager
DoneVerified
Done byWhenNote

At exitT0, the moment access ends

4. Queue the mailbox removal on phones, before you block sign-in
The account-only wipe removes the mailbox and its mail from a personal phone and leaves the rest of the phone alone.
- Microsoft documents that the wipe is delivered the next time the phone connects to Exchange. A blocked account may be refused that connection, which is my reading and not a statement from Microsoft, so for a planned leaver this runs before the block.
- The Outlook app only ever receives an account-only wipe. A native mail app on a personal phone is wiped of its Exchange mail, calendar and account data and nothing else.
Review before running. Test on a test account first. Exchange Online PowerShell
```
Get-MobileDevice -Mailbox $upn
Get-MobileDevice -Mailbox $upn | Clear-MobileDevice -AccountOnly
```
Check it worked
In the Exchange admin center the device status changes from Wipe Pending to Wipe Successful once the phone has connected.
Review before running. Test on a test account first. PowerShell
```
Get-MobileDeviceStatistics -Mailbox $upn
```
Keep as evidence
The device list before and after, and the status the Exchange admin center shows, with the date.
Read on Microsoft Learn: Remote wipe on a mobile phone (Exchange Online), Get-MobileDeviceStatistics
Record the evidence for this step
Evidence for Queue the mailbox removal on phones, before you block sign-in
DoneVerified
Done byWhenNote
5. Block sign-in
Needs user Administrator for non-admin accounts, or Privileged Authentication Administrator for admin accounts.
A disabled account cannot get new tokens, which stops new sign-ins in every app that uses Microsoft Entra ID.
- Block sign-in when the last working time ends.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "User.EnableDisableAccount.All","User.Read.All"
Update-MgUser -UserId $userId -AccountEnabled:$false
```
Check it worked
AccountEnabled reads False.
Review before running. Test on a test account first. PowerShell
```
Get-MgUser -UserId $userId -Property AccountEnabled | Select-Object AccountEnabled
```
Keep as evidence
The output of the verification command with date and time.
Read on Microsoft Learn: Revoke user access in Microsoft Entra ID, user: update (permissions for accountEnabled and passwordProfile)
Record the evidence for this step
Evidence for Block sign-in
DoneVerified
Done byWhenNote
6. Revoke sign-in sessions
It invalidates refresh tokens and browser session cookies, so every app has to ask Microsoft Entra ID for a new token and now cannot get one.
- It can take a few minutes to take effect, and it does not apply to guest users.
- An access token that was already issued stays valid until it expires, one hour by default. Apps that keep their own session also need the account removed in the app, which the SaaS checklist below covers.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "User.RevokeSessions.All"
Revoke-MgUserSignInSession -UserId $userId
```
Check it worked
The sign-in sessions timestamp is the time you ran the command.
Review before running. Test on a test account first. PowerShell
```
Get-MgUser -UserId $userId -Property SignInSessionsValidFromDateTime | Select-Object SignInSessionsValidFromDateTime
```
Keep as evidence
The output of the verification command with date and time.
Read on Microsoft Learn: user: revokeSignInSessions, Revoke user access in Microsoft Entra ID
Record the evidence for this step
Evidence for Revoke sign-in sessions
DoneVerified
Done byWhenNote
7. Set a random password nobody has seen
The old password stops working even if the account is enabled again by mistake or later converted to a shared mailbox.
- Do not store the new password. Nobody needs it.
- For a synced account, do this in Active Directory.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "User-PasswordProfile.ReadWrite.All"
$bytes = New-Object byte[] 24
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
$password = [Convert]::ToBase64String($bytes) + 'Aa1!'
Update-MgUser -UserId $userId -PasswordProfile @{ Password = $password; ForceChangePasswordNextSignIn = $true }
Remove-Variable password,bytes
```
Check it worked
The audit log shows a password event for the leaver at that time.
Review before running. Test on a test account first. PowerShell
```
Get-MgAuditLogDirectoryAudit -All | Where-Object { $_.TargetResources.Id -contains $userId -and $_.ActivityDisplayName -in 'Reset password','Change user password' } | Select-Object ActivityDateTime,ActivityDisplayName
```
Keep as evidence
The audit event row with its time.
Read on Microsoft Learn: Update-MgUser, user: update (permissions for accountEnabled and passwordProfile)
Record the evidence for this step
Evidence for Set a random password nobody has seen
DoneVerified
Done byWhenNote
8. Retire or wipe the managed devices
Needs cloud Device Administrator at minimum for the Microsoft Entra device step, and an Intune role that can run remote actions.
An Intune retire or wipe is the one action here that reaches the device itself, and a retire waits for the next time the device checks in.
- Wipe company-owned devices. Retire personal devices, which removes company data and leaves the rest.
- A wipe cannot be undone. Data on the device is gone.
- Disable the Microsoft Entra device objects only after the devices are returned, and skip it if a device is reissued today.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All","DeviceManagementManagedDevices.PrivilegedOperations.All"
Get-MgDeviceManagementManagedDevice -Filter "userPrincipalName eq '$upn'" | Select-Object Id,DeviceName,OperatingSystem,ManagedDeviceOwnerType
Invoke-MgRetireDeviceManagementManagedDevice -ManagedDeviceId '<device-id>'
Clear-MgDeviceManagementManagedDevice -ManagedDeviceId '<device-id>' -BodyParameter @{ keepEnrollmentData = $false; keepUserData = $false }
Connect-MgGraph -Scopes "Directory.AccessAsUser.All"
Get-MgUserRegisteredDevice -UserId $userId -All | ForEach-Object { Update-MgDevice -DeviceId $_.Id -AccountEnabled:$false }
```
Check it worked
Each device shows a retire or wipe issued or completed, and the Microsoft Entra devices read as disabled.
Review before running. Test on a test account first. PowerShell
```
Get-MgDeviceManagementManagedDevice -Filter "userPrincipalName eq '$upn'" | Select-Object DeviceName,ManagementState,LastSyncDateTime
```
Keep as evidence
The device list with management state before and after, and the hardware return record.
Read on Microsoft Learn: Wipe devices in Intune, Device action: Retire, device: update (roles that can disable a device)
Record the evidence for this step
Evidence for Retire or wipe the managed devices
DoneVerified
Done byWhenNote

T+1 dayThe day after

8 steps

9. Remove directory roles, including PIM eligible roles
Needs privileged Role Administrator.
An eligible role does not show in the active list, and it returns the day the account is enabled again.
- Uses $upn, $userId, $manager and $managerId from the Prepare step.
- Roles can also arrive through a group. From the inventory, check every group the leaver belongs to: Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '<group-id>'".
- For an eligible role, use the role definition id and scope from the listing in the removal request.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory","RoleEligibilitySchedule.ReadWrite.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$userId'"
Remove-MgRoleManagementDirectoryRoleAssignment -UnifiedRoleAssignmentId '<role-assignment-id>'
Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -Filter "principalId eq '$userId'"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{ Action = 'AdminRemove'; PrincipalId = $userId; RoleDefinitionId = '<role-definition-id>'; DirectoryScopeId = '/'; Justification = 'Leaver' }
```
Check it worked
Both listings return nothing for the leaver.
Review before running. Test on a test account first. PowerShell
```
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$userId'"
Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance -Filter "principalId eq '$userId'"
```
Keep as evidence
Both listings before and after, with the date.
Read on Microsoft Learn: Assign Microsoft Entra roles in PIM with PowerShell
Record the evidence for this step
Evidence for Remove directory roles, including PIM eligible roles
DoneVerified
Done byWhenNote
10. Remove delegated consents and app role assignments
Needs an administrator who can manage enterprise applications.
Deleting a delegated grant revokes the access it gave, and tokens already issued still live out their lifetime, which is why sessions were revoked first.
- Uses $upn, $userId, $manager and $managerId from the Prepare step.
- Read the list before you remove anything. A consent can belong to an app the business still depends on.
- Add -WhatIf to a removal line to preview it.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "DelegatedPermissionGrant.ReadWrite.All","AppRoleAssignment.ReadWrite.All","Directory.Read.All"
Get-MgUserOauth2PermissionGrant -UserId $userId -All
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId '<grant-id>'
Get-MgUserAppRoleAssignment -UserId $userId -All | Select-Object Id,ResourceDisplayName,AppRoleId
Remove-MgUserAppRoleAssignment -UserId $userId -AppRoleAssignmentId '<assignment-id>'
```
Check it worked
Both listings return nothing, or only grants you decided to keep.
Review before running. Test on a test account first. PowerShell
```
Get-MgUserOauth2PermissionGrant -UserId $userId -All
Get-MgUserAppRoleAssignment -UserId $userId -All
```
Keep as evidence
Both listings before and after, with the date.
Read on Microsoft Learn: Remove-MgOauth2PermissionGrant, Delete appRoleAssignment from a user
Record the evidence for this step
Evidence for Remove delegated consents and app role assignments
DoneVerified
Done byWhenNote
11. Hand over the groups, apps and teams the leaver owns
Needs an administrator who can manage groups and applications.
An object whose only owner has left cannot be managed by its owner any more, so it is handed over before the account changes again.
- Uses $upn, $userId, $manager and $managerId from the Prepare step.
- Read the owned objects first. For each one, add the manager as owner, then remove the leaver.
- Flows and apps the leaver owns in the Power Platform are transferred in the Power Platform admin center, not here.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "Group.ReadWrite.All","Application.ReadWrite.All","Directory.Read.All"
Get-MgUserOwnedObject -UserId $userId -All
$groupOwner = @{ "@odata.id" = "https://graph.microsoft.com/v1.0/users/$managerId" }
New-MgGroupOwnerByRef -GroupId '<group-id>' -BodyParameter $groupOwner
Remove-MgGroupOwnerByRef -GroupId '<group-id>' -DirectoryObjectId $userId
$appOwner = @{ "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$managerId" }
New-MgApplicationOwnerByRef -ApplicationId '<application-object-id>' -BodyParameter $appOwner
Remove-MgApplicationOwnerByRef -ApplicationId '<application-object-id>' -DirectoryObjectId $userId
New-MgServicePrincipalOwnerByRef -ServicePrincipalId '<service-principal-id>' -BodyParameter $appOwner
Remove-MgServicePrincipalOwnerByRef -ServicePrincipalId '<service-principal-id>' -DirectoryObjectId $userId
```
Review before running. Test on a test account first. Microsoft Teams PowerShell
```
Connect-MicrosoftTeams
Get-Team -User $upn
Get-TeamUser -GroupId '<team-group-id>' -Role Owner
Add-TeamUser -GroupId '<team-group-id>' -User $manager -Role Owner
Remove-TeamUser -GroupId '<team-group-id>' -User $upn
```
Check it worked
The owned-objects listing returns nothing the business still needs, and each team has an owner other than the leaver.
Review before running. Test on a test account first. PowerShell
```
Get-MgUserOwnedObject -UserId $userId -All
Get-Team -User $upn
```
Keep as evidence
The listing before and after, and the owner list of each team you changed.
Read on Microsoft Learn: Add-TeamUser
Record the evidence for this step
Evidence for Hand over the groups, apps and teams the leaver owns
DoneVerified
Done byWhenNote
12. Check and remove mailbox forwarding and inbox rules
Needs an Exchange Online administrator role. Get-InboxRule does not work for Global Reader or View-Only Organization Management.
Forwarding and inbox rules live in Exchange, not Microsoft Entra ID, they keep sending mail to an outside address after the account is blocked, and they survive a conversion to a shared mailbox.
- Do this before you convert or delete the mailbox.
- Hidden rules are included on purpose. Review each rule before you remove it: Remove-InboxRule asks for confirmation on every rule.
- Forwarding you set up on purpose for the handover is an option Microsoft describes for former employees. Removing the licence stops that forwarding, so keep it only for as long as the handover needs it, and remove anything you did not set up and anything that points outside the organisation.
- List who has Full Access, Send As and Send on Behalf on the mailbox, and remove anyone who should not. Get-RecipientPermission is the command that lists Send As.
Review before running. Test on a test account first. Exchange Online PowerShell
```
Get-Mailbox $upn | Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward
Get-InboxRule -Mailbox $upn -IncludeHidden | Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } | Format-List Name,Enabled,ForwardTo,ForwardAsAttachmentTo,RedirectTo
# Remove forwarding you did not set up on purpose:
Set-Mailbox -Identity $upn -ForwardingAddress $null -ForwardingSmtpAddress $null
# Remove rules that forward or redirect, one confirmation per rule:
Get-InboxRule -Mailbox $upn -IncludeHidden | Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } | Remove-InboxRule
# Who has Full Access, Send As and Send on Behalf:
Get-MailboxPermission -Identity $upn
Get-RecipientPermission -Identity $upn
Get-Mailbox $upn | Format-List GrantSendOnBehalfTo
```
Check it worked
Both forwarding properties are empty and the rule listing returns nothing.
Review before running. Test on a test account first. PowerShell
```
Get-Mailbox $upn | Format-List ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward
Get-InboxRule -Mailbox $upn -IncludeHidden | Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo }
```
Keep as evidence
The forwarding and rule listings before and after, with the date.
Read on Microsoft Learn: Configure email forwarding for a mailbox, Get-InboxRule, Remove a former employee: forward email or convert to a shared mailbox
Record the evidence for this step
Evidence for Check and remove mailbox forwarding and inbox rules
DoneVerified
Done byWhenNote
13. Convert the mailbox to a shared mailbox for the manager
Needs an Exchange Online administrator role.
A shared mailbox keeps the mail for the team without a licence, as long as it stays under 50 GB and carries no hold.
- The licence can be removed after conversion only if the mailbox is under 50 GB and not on hold. Over 50 GB it needs an Exchange Online Plan 2 licence. A hold needs Plan 2, or Plan 1 with the Exchange Online Archiving add-on.
- With forwarding set, the licence cannot be removed. Clear forwarding first.
- Never delete this account later: in Exchange Online the shared mailbox is the user object, kept disabled.
- You do not have to reset the password for the conversion, but the original user name and password keep working on the shared mailbox if you do not. The password step above covers that.
- Edit the auto-reply text before you run it.
Review before running. Test on a test account first. Exchange Online PowerShell
```
Get-MailboxStatistics -Identity $upn | Format-List TotalItemSize
Set-MailboxAutoReplyConfiguration -Identity $upn -AutoReplyState Enabled -InternalMessage "This person has left. Please contact their manager." -ExternalMessage "This person has left the company. Please contact the company directly."
Set-Mailbox -Identity $upn -Type Shared
Add-MailboxPermission -Identity $upn -User $manager -AccessRights FullAccess -InheritanceType All -AutoMapping $true
```
Check it worked
The mailbox type reads SharedMailbox and the manager appears in the permission list.
Review before running. Test on a test account first. PowerShell
```
Get-Mailbox $upn | Format-List RecipientTypeDetails
Get-MailboxPermission -Identity $upn
```
Keep as evidence
The mailbox size, type and permission list, with the date.
Read on Microsoft Learn: Convert a user mailbox to a shared mailbox, Convert a mailbox in Exchange Online
Record the evidence for this step
Evidence for Convert the mailbox to a shared mailbox for the manager
DoneVerified
Done byWhenNote
14. Give the manager access to the OneDrive files
Needs sharePoint Administrator, or a Microsoft 365 admin who can use Active users.
Removing a licence does not delete the OneDrive, and deleting the user starts a retention period, so the files are handed over while the account still exists.
- Admin center route: Users, Active users, select the leaver, OneDrive, Create link to files.
- Or find the OneDrive address and make the manager a site collection administrator, as below.
- Replace <tenant> with your tenant name and <leaver-onedrive-url> with the address the listing returns.
Review before running. Test on a test account first. SharePoint Online Management Shell
```
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Get-SPOSite -IncludePersonalSite $true -Limit all -Filter "Url -like '-my.sharepoint.com/personal/'" | Where-Object { $_.Owner -eq $upn } | Select-Object Url,Owner
Set-SPOUser -Site '<leaver-onedrive-url>' -LoginName $manager -IsSiteCollectionAdmin $true
```
Check it worked
The manager can open the OneDrive and copy out what the business needs.
Keep as evidence
The OneDrive address, the date access was granted, and the name of who took the files.
Read on Microsoft Learn: Remove a former employee: access to OneDrive, Get a list of all user OneDrive URLs
Record the evidence for this step
Evidence for Give the manager access to the OneDrive files
DoneVerified
Done byWhenNote
15. Remove the leaver from groups
Needs an administrator who can manage group membership.
Group membership grants Teams, SharePoint sites and apps, and a licence group is what holds the licence.
- Uses $upn, $userId, $manager and $managerId from the Prepare step.
- Groups synced from Active Directory change in Active Directory. Dynamic groups update by rule.
- If the licence comes from a group, removing the leaver from that group is how the licence goes.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "Group.ReadWrite.All","Directory.Read.All"
Get-MgUserMemberOfAsGroup -UserId $userId -All | Select-Object Id,DisplayName,GroupTypes
Remove-MgGroupMemberByRef -GroupId '<group-id>' -DirectoryObjectId $userId
```
Check it worked
The membership listing returns only groups that are managed elsewhere.
Review before running. Test on a test account first. PowerShell
```
Get-MgUserMemberOfAsGroup -UserId $userId -All | Select-Object Id,DisplayName,GroupTypes
```
Keep as evidence
The membership listing before and after, with the date.
Read on Microsoft Learn: Microsoft Entra groups with Microsoft Graph PowerShell
Record the evidence for this step
Evidence for Remove the leaver from groups
DoneVerified
Done byWhenNote
16. Remove the licences, last
Needs license Administrator or User Administrator.
Licences go last because the mailbox, the files and any hold depend on them, and then the seats stop costing money.
- Uses $upn, $userId, $manager and $managerId from the Prepare step.
- Skip this if the mailbox is over 50 GB, on hold, or still forwarding: it needs a licence.
- A licence that comes from a group goes when the leaver is taken out of that group, which the group step above does. The command reads which licences are assigned to the account directly, because the plain licence list does not say which ones a group gave, and removes only those.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"
Get-MgUserLicenseDetail -UserId $userId | Select-Object SkuPartNumber,SkuId
$states = (Get-MgUser -UserId $userId -Property LicenseAssignmentStates).LicenseAssignmentStates
$skus = @($states | Where-Object { -not $_.AssignedByGroup } | Select-Object -ExpandProperty SkuId -Unique)
if ($skus.Count -gt 0) { Set-MgUserLicense -UserId $userId -RemoveLicenses $skus -AddLicenses @{} }
```
Check it worked
The licence listing returns nothing, or only licences a group still gives, which go with the group step.
Review before running. Test on a test account first. PowerShell
```
Get-MgUserLicenseDetail -UserId $userId
```
Keep as evidence
The licence list before and after, with the date.
Read on Microsoft Learn: Set-MgUserLicense, Remove licenses from user accounts with PowerShell, licenseAssignmentState (direct or inherited from a group)
Record the evidence for this step
Evidence for Remove the licences, last
DoneVerified
Done byWhenNote

T+30 daysOne month later

3 steps

17. Check that nothing has moved since the exit
Needs reports Reader, Security Reader or Security Administrator for the sign-in log.
A leaver can still hold something that was missed, and day 30 is when it shows.
- Uses $upn, $userId, $manager and $managerId from the Prepare step.
- Microsoft Entra keeps sign-in logs for 7 days on Free and 30 days with P1 or P2, so on a Free tenant run this earlier, or export the log at exit.
- Compare the results with the inventory from the Prepare step.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "AuditLog.Read.All","Directory.Read.All","RoleManagement.Read.Directory","User.Read.All"
$since = (Get-Date).ToUniversalTime().AddDays(-30)
Get-MgAuditLogSignIn -Filter "userPrincipalName eq '$upn'" -All | Where-Object { [datetime]$_.CreatedDateTime -ge $since } | Select-Object CreatedDateTime,AppDisplayName,IPAddress,@{ n = 'ErrorCode'; e = { $_.Status.ErrorCode } }
Get-MgUserMemberOfAsGroup -UserId $userId -All | Select-Object Id,DisplayName
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$userId'"
Get-MgUserOauth2PermissionGrant -UserId $userId -All
Get-MgUserLicenseDetail -UserId $userId | Select-Object SkuPartNumber
```
Review before running. Test on a test account first. Exchange Online PowerShell
```
Get-Mailbox $upn | Format-List ForwardingAddress,ForwardingSmtpAddress,LitigationHoldEnabled,InPlaceHolds
Get-InboxRule -Mailbox $upn -IncludeHidden | Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo }
Get-MailboxStatistics -Identity $upn | Format-List TotalItemSize
```
Check it worked
Every sign-in row has a non-zero error code, and there is no new rule, group, role, consent or licence.
Keep as evidence
The sweep output with the date, and a note of anything that changed.
Read on Microsoft Learn: Get-MgAuditLogSignIn, Microsoft Entra data retention
Record the evidence for this step
Evidence for Check that nothing has moved since the exit
DoneVerified
Done byWhenNote
18. Close the accounts that sit outside single sign-on
An app that does not use Microsoft Entra ID keeps its own login, so blocking the Microsoft account never reaches it.
- Work through your list and record who removed each account and when.
- Also check shared passwords the leaver knew, API keys and personal access tokens they created, vault entries, registrar and DNS logins, and company cards.
- An app that supports it should be provisioned and deprovisioned from Microsoft Entra ID, which makes this step shorter next time. Where that is set up, Microsoft documents a synchronisation about every 40 minutes.
Check it worked
Every line on your list has a name and a date beside it.
Keep as evidence
The completed checklist.
Read on Microsoft Learn: Revoke user access in Microsoft Entra ID, Provision users and groups with SCIM in Microsoft Entra ID
- No product named yet. List every account that does not sign in through Microsoft Entra ID, then work through the list.
  Record who removed each account and when
  Evidence for No product named yet. List every account that does not sign in through Microsoft Entra ID, then work through the list.
  DoneVerified
  Done byWhenNote
Record the evidence for this step
Evidence for Close the accounts that sit outside single sign-on
DoneVerified
Done byWhenNote
19. Confirm the hardware is back and the register is updated
A device that is still out is access that no command can remove.
- Check laptops, phones, security keys, badges and storage devices against the serial numbers recorded at exit.
- Update the asset register, and chase anything outstanding in writing.
Check it worked
Every item recorded at exit is either returned or has a named follow-up.
Keep as evidence
The updated asset register line for each item.
Read on Microsoft Learn: Remove a former employee
Record the evidence for this step
Evidence for Confirm the hardware is back and the register is updated
DoneVerified
Done byWhenNote

T+90 daysThree months later

2 steps

20. Confirm the shared mailbox account stays blocked
In Exchange Online the shared mailbox is the user object, so it stays, and it must stay disabled and out of sign-in.
- Do not delete this account. Deleting it deletes the shared mailbox, with a 30-day restore window.
- Uses $upn, $userId, $manager and $managerId from the Prepare step.
Review before running. Test on a test account first. Microsoft Graph PowerShell
```
Connect-MgGraph -Scopes "User.Read.All"
Get-MgUser -UserId $userId -Property AccountEnabled | Select-Object AccountEnabled
Get-MgUserLicenseDetail -UserId $userId | Select-Object SkuPartNumber
```
Check it worked
AccountEnabled reads False and the licence list is empty, unless the mailbox needs one.
Keep as evidence
The output with the date.
Read on Microsoft Learn: Convert a mailbox in Exchange Online
Record the evidence for this step
Evidence for Confirm the shared mailbox account stays blocked
DoneVerified
Done byWhenNote
21. Close the record
The record is the proof that the leaver was handled, and it is only useful if it is complete and filed.
- Check that every step in the evidence record has a done mark, a verified mark, a name and a time.
- File the record where HR keeps the leaver file, and keep it as long as your own retention schedule says.
Review before running. Test on a test account first. PowerShell
```
Stop-Transcript
```
Check it worked
The evidence record has no empty row.
Keep as evidence
The completed evidence record and the transcript file.
Read on Microsoft Learn: Start-Transcript
Record the evidence for this step
Evidence for Close the record
DoneVerified
Done byWhenNote

Loading the leaver check.

How the runbook changes

What changes by type of departure

Standard

Planned departure, normal working relationship.

A planned exit, so the account-only wipe of mail on phones is queued before sign-in is blocked.
Directory roles come off on T+1, with the rest of the account clean-up.
No hold, mailbox protocol lock or authentication-method removal: those steps appear for the other two types.

Sensitive

Privileged, finance or admin access, or a move to a competitor.

A hold is checked in Prepare, because a mailbox hold needs the right Exchange plan.
The mailbox and the sign-in log are preserved at exit, before roles come off and devices are retired.
Directory roles come off at exit, not the day after, and registered authentication methods are removed on T+1.

Hostile or dismissal

Immediate exit, for cause, or under investigation.

At exit, sign-in is blocked first and sessions are revoked straight after.
Mailbox protocols are closed, so no client keeps a connection while the account is under review.
Preservation comes before any deletion, and the phone mail wipe is queued after the block, not before.

AssertedThe order and the three types are my recommendation. CIS Controls v8.1, safeguard 6.2, asks for a process to revoke access, preferably automated, that disables accounts when someone leaves, and notes that disabling instead of deleting can keep an audit trail. The runbook follows that order. CIS Critical Security Controls v8.1.

Why the runbook has these steps

Five ways a leaver keeps access

AssertedEach one is documented by Microsoft, and the page it comes from is linked.

A token or session that is already issued
Blocking sign-in stops new tokens. An access token still works until it expires, one hour by default, and an app that keeps its own session cookie keeps it until that app ends it. Revoke the sessions in the same step as the block.
Read on Microsoft Learn: Revoke user access in Microsoft Entra ID
An app that does not use the Microsoft account
Blocking the Microsoft account never reaches an app with its own login. Where automatic deprovisioning is set up, Microsoft documents a synchronisation about every 40 minutes, and the rest is a manual list. The runbook turns the product names you enter into that list.
Read on Microsoft Learn: Revoke user access in Microsoft Entra ID, Provision users and groups with SCIM in Microsoft Entra ID
A device that is offline
A retire from Intune is carried out the next time the device checks in with Intune. A device that never checks in again keeps whatever is stored on it, so recovering the hardware is the control.
Read on Microsoft Learn: Device action: Retire, Wipe devices in Intune
Mail that keeps being forwarded
Forwarding and inbox rules live in Exchange, not in Microsoft Entra ID, so blocking the account does not remove them. Check both before you convert or delete the mailbox. The leaver check prints the two commands that find them.
Read on Microsoft Learn: Configure email forwarding for a mailbox, Get-InboxRule
Consents and objects tied to the account
The apps a leaver gave permission to, and the apps, groups and teams they own, are separate records in the tenant. The runbook reviews both before the licence is removed, and the leaver check lists them for disabled accounts.
Read on Microsoft Learn: Remove-MgOauth2PermissionGrant

Reference

Where leaver records are looked for

AssertedContext only. Neither reference prescribes this runbook, and following it is not a certification or an audit result. The table says which steps leave a record next to each reference, so you know where to look.

The NIS2 references point to Article 21(2) of Directive (EU) 2022/2555. A directive binds an organisation only through its own country's law; in Malta that is S.L. 460.41 (Legal Notice 71 of 2025, as amended), whose article 19 carries the same list. A reference here is context for your reviewer, not a compliance check.

References to leaver controls and the runbook steps that leave a related record
Reference	What it covers	Runbook steps with a related record
NIS2, Article 21(2)(i)	Human resources security, access control policies and asset management are among the measures the Directive lists.	Block sign-in, Remove directory roles, including PIM eligible roles, Confirm the hardware is back and the register is updated, Close the record

FAQ

Questions from admins

Does anything here change my tenant?

No. The runbook is text you review and run yourself, and the leaver check asks for read permissions only. Neither has a permission to change anything.

Why block sign-in and revoke sessions as two steps?

Blocking sign-in stops new tokens. Revoking sessions invalidates the refresh tokens already issued. An access token still lasts until it expires, one hour by default, and an app that keeps its own session lasts until that app ends it, so the runbook also lists the apps outside Microsoft Entra ID.

Should I disable or delete the account?

Disable it first. Deleting starts a 30-day restore window, after which the mailbox and OneDrive follow their retention settings. The runbook keeps the account disabled until the mailbox and files are handed over and the 30-day check is done.

What does the leaver check need?

An administrator who can approve apps for your tenant approves it once, and then you sign in as a Global Reader. Last sign-in and the 90-day list need Entra ID P1 or P2, and the device check needs an Intune licence. A check that cannot be read says so and is never shown as clear.

What does the leaver check keep?

For ten minutes, the account, display, device and app names of the disabled accounts it reads and of the enabled accounts it flags, encrypted under a key Upstash does not hold, at Upstash in Ireland, inside the EEA. No sign-in token, and no mail or file content. Delete this scan now removes it sooner. The runbook builder keeps nothing, because it runs in your browser.

Does it cover Google Workspace or other directories?

No. It covers Microsoft 365 with Microsoft Entra ID, cloud only or hybrid with Active Directory. Other apps appear as a checklist you fill in from the product names you enter.

Want the leaver chain run for you?

Joiner and leaver automation on Microsoft 365, triggered from your HR system, with every run logged as a record. Fixed scope, from Malta.

See the onboarding and offboarding service

Before you start

Build the runbook

PrepareBefore the last day

1. Connect and name the leaver and the manager

2. Record what the account holds today

3. Agree the handover with the manager

At exitT0, the moment access ends

4. Queue the mailbox removal on phones, before you block sign-in

5. Block sign-in

6. Revoke sign-in sessions

7. Set a random password nobody has seen

8. Retire or wipe the managed devices

T+1 dayThe day after

9. Remove directory roles, including PIM eligible roles

10. Remove delegated consents and app role assignments

11. Hand over the groups, apps and teams the leaver owns

12. Check and remove mailbox forwarding and inbox rules

13. Convert the mailbox to a shared mailbox for the manager

14. Give the manager access to the OneDrive files

15. Remove the leaver from groups

16. Remove the licences, last

T+30 daysOne month later

17. Check that nothing has moved since the exit

18. Close the accounts that sit outside single sign-on

19. Confirm the hardware is back and the register is updated

T+90 daysThree months later

20. Confirm the shared mailbox account stays blocked

21. Close the record

What changes by type of departure

Standard

Sensitive

Hostile or dismissal

Five ways a leaver keeps access

A token or session that is already issued

An app that does not use the Microsoft account

A device that is offline

Mail that keeps being forwarded

Consents and objects tied to the account

Where leaver records are looked for

Questions from admins

Want the leaver chain run for you?