IT Onboarding and Offboarding Checklist for Small Business

IT onboarding means a new hire has a working account, the right access, and a secured device on day one. IT offboarding means that on someone’s last day their sign-in stops working, their email and files pass to the right person, company data comes off their devices, and the license is freed. Both go well when they are written checklists with one named owner. The two checklists below are written for Microsoft 365, with menu paths current as of September 2026, and the same order applies on other platforms.

Before You Start: A One-Page Access Record

Offboarding is only as good as your record of what each person can reach. Keep one page per employee (a spreadsheet row works) listing:

• Microsoft 365 license and group memberships
• Shared mailboxes and calendars they can open
• Other business apps with their own sign-in: accounting, payroll, CRM, scheduling, banking, vendor portals
• Shared passwords they know: Wi-Fi, alarm and door codes, social media, the copier
• Devices issued, with serial numbers, and any personal devices that hold company email
• Admin roles, and any account where their phone number or email is the recovery method

Fill it in during onboarding and update it when roles change. It turns the last day from detective work into a list.

IT Onboarding Checklist

Before day one

1. Get the details from the hiring manager. Name, start date, role, manager, and which existing employee has similar access needs.
2. Create the account. In the Microsoft 365 admin center go to Users > Active users > Add a user. Assign the license at the same time. Set the manager field, because Microsoft uses it later to decide who receives access to the person’s OneDrive if the account is deleted.
3. Add groups by role, not by copying a person. Add the user to the groups, Teams, and shared mailboxes the role needs. Copying a long-serving employee’s access copies everything they have accumulated.
4. Confirm multi-factor authentication will apply. With security defaults or a Conditional Access policy in place, the new user is prompted to register at first sign-in. See why MFA matters and our Entra ID settings guide.
5. Prepare the device. Update it, confirm disk encryption is on, enroll it in your device management tool if you use one, and install the apps the role needs. Record the serial number.
6. Set up other apps. Create accounts in each business app with the lowest permission level that lets the person do the job.
7. Share credentials through a password manager. A business password manager lets you grant and later revoke shared logins without emailing passwords.

Day one

1. Hand over the temporary password in person or through the password manager, and have the employee change it at first sign-in.
2. Register MFA together, using an authenticator app. Confirm it works.
3. Sign in to email, Teams, OneDrive, and each business app, and confirm the right shared folders and mailboxes appear.
4. If a personal phone will hold company email, walk through the BYOD policy, have it signed, and set up the protected apps.
5. Cover the basics in ten minutes: how to report a suspicious email, where files belong, who to ask for IT help. Our guide to spotting phishing emails is a reasonable handout.
6. Complete the access record.

First week

Check that nothing was over-granted, that the device shows as healthy in your management tool, and that the employee is not still using a temporary workaround such as a colleague’s login.

IT Offboarding Checklist

Do these in order. The first three happen at the agreed time on the last day, or immediately for an unplanned departure. Coordinate timing with whoever is handling the conversation so access ends neither early nor late.

1. Reset the password and sign out all sessions

Microsoft’s first offboarding step is a password reset followed by a forced sign-out. In Users > Active users, select the user, choose Reset password, then on the Account tab choose Sign out of all sessions.

Microsoft notes that the person may stay signed in for up to an hour, because an access token already issued remains valid for that long.

2. Block sign-in

On the same user, select Block sign-in. Do this as well as the password reset, not instead of it. Microsoft warns that blocking alone “can take up to 24 hours to take effect”, which is why the reset comes first.

3. Remove company data from devices

Collect company-owned equipment. For phones and personal devices:

• With Intune: Devices > All devices, select the device, then Retire (removes company data only, for personal devices) or Wipe (factory reset, for company devices).
• Without Intune: Microsoft’s device step uses the Exchange admin center. Go to Recipients > Mailboxes, open the user’s mobile devices, choose the account-only remote wipe, then block the device.

4. Decide what happens to email: forward or shared mailbox

	Forward new email	Convert to shared mailbox
What the successor gets	New messages only	All existing mail and calendar, plus new messages
License needed	The original account must stay in place	None if the mailbox is under 50 GB
Best when	A short handover is enough	Customers will keep writing to that address, or history matters

Both routes are in Microsoft’s forwarding and shared mailbox step. Two cautions from Microsoft: do not delete the account if you use forwarding or a shared mailbox, because the account anchors it, and convert the mailbox before removing the license. Microsoft’s shared mailbox guidance adds that sign-in should stay blocked on the shared mailbox’s account and that a license is required above 50 GB.

Also set an automatic reply naming the new contact, and remove any forwarding rules the employee created to outside addresses.

5. Hand over OneDrive files

Give the manager or successor access to the person’s OneDrive and have them move what the business needs into a shared location such as SharePoint. Personal OneDrive folders are a poor permanent home for company records.

6. Remove group memberships and admin roles

Remove the user from groups, Teams, and shared mailboxes, and remove any admin roles. If the person was the only Global Administrator, assign another before doing anything else.

7. Work through the access record for everything outside Microsoft 365

• Disable or reassign accounts in accounting, payroll, banking, CRM, and vendor portals
• Change shared passwords they knew: Wi-Fi, alarm and door codes, social media, shared logins
• Revoke their access in the password manager
• Replace their phone number or email wherever it is a recovery or MFA method, including the domain registrar, bank, and phone carrier accounts
• Transfer ownership of anything registered in their name, such as a domain, an ad account, or a software subscription

8. Remove the license, then delete the account

Once mail and files are handled, remove the license so you can reassign it or reduce your subscription. When nothing depends on the account (no forwarding, no shared mailbox), delete it. Details are in the retention section below.

9. Record completion

Note the date each step was done and by whom. If a question comes up months later, that record answers it.

How Long Does Microsoft 365 Keep a Former Employee’s Data?

These are Microsoft’s defaults, from its offboarding overview and OneDrive retention documentation. Retention policies or legal holds you have configured override them.

Action	What happens to the data
License removed, mailbox not converted	Email, contacts, and calendar are retained for 30 days, then permanently deleted
Account deleted	The account can be restored for 30 days, with its mail and OneDrive
Account deleted, OneDrive	The manager is given access automatically by default and has 30 days to copy files. The period can be changed in the SharePoint admin center
After the OneDrive retention period	The OneDrive moves to a recycle bin state for 93 days, recoverable only with PowerShell
OneDrive left without a license	Automatically archived on its 93rd unlicensed day

The practical lesson: these windows are short. If the business may need a former employee’s records for tax, contract, or legal reasons, move them somewhere permanent during offboarding. If a dispute with the departing employee is possible, speak to your attorney before deleting anything. Microsoft 365 can place a legal hold on the data through Purview eDiscovery.

Native retention is not a backup. See our guides to Microsoft 365 backup and email archiving if you need records kept longer.

If your accounts sync from an on-premises Active Directory server, Microsoft notes that users must be disabled and deleted in the local directory, not in Microsoft 365.

Who Should Own the Process?

One person, by name, with a backup. In a small office that is often the office manager. Decide in advance:

• Who tells the owner about a hire or departure, and with how much notice
• Who is authorized to approve access changes
• Who carries out the technical steps, whether that is someone in the office or an IT provider
• Where the checklists and access records are kept

Departures without notice are the real test. The owner should be able to carry out offboarding steps 1 and 2 within minutes, or reach someone who can.

Common Mistakes

• Blocking sign-in without resetting the password and signing out sessions, which can leave access open for hours.
• Removing the license before converting the mailbox, which starts a 30-day countdown on the mail.
• Deleting the account while forwarding still depends on it.
• Handling Microsoft 365 and forgetting the accounting system, the bank, and the shared Wi-Fi password.
• Leaving a departed employee’s phone as the MFA or recovery method on a critical account.
• Letting a former employee’s mailbox forward to their personal address “for a few weeks”.
• Treating onboarding as a laptop handover and skipping MFA registration.

Common Questions

How quickly should a former employee’s access be removed?

At the agreed end of their last day, or immediately for an unplanned departure. Reset the password, sign out all sessions, and block sign-in together. Microsoft documents that an existing session can persist for up to an hour and that blocking alone can take up to 24 hours, so use all three.

Should we delete a former employee’s Microsoft 365 account right away?

No. Block it right away, but delete it only after email and OneDrive files have been handed over. If you set up forwarding or convert the mailbox to a shared mailbox, Microsoft says the account must remain. A shared mailbox under 50 GB does not need a license, so keeping it costs nothing.

Can we keep a former employee’s email address working?

Yes. Either forward new mail to a colleague or convert the mailbox to a shared mailbox that several people can open. Conversion keeps the full history and needs no license under 50 GB. Add an automatic reply that names the new contact so senders update their records.

What if the person who left was our only administrator?

Regain control before anything else. If another Global Administrator exists, use that account. If not, this is exactly the situation Microsoft’s emergency access accounts are designed to prevent. Set up two of them now, while you still have an administrator, as described in our Conditional Access guide.

How Coastal Growth Co. Can Help

We build onboarding and offboarding checklists around your actual systems, create the access record for current staff, and can carry out the account and device steps when someone joins or leaves. For ongoing arrangements we agree in advance who authorizes changes and how requests reach us. Scope and price are agreed before paid work begins. See our managed IT services or contact us.