What should an IT onboarding and offboarding checklist include?

By LAN Service Group · Reviewed October 4, 2026

Why this matters more than it looks

Onboarding and offboarding are where access control is won or lost. New hires given broad access on day one keep it for years. Departing employees whose accounts linger keep a path to your data.

Microsoft's shared responsibility guidance notes that, whatever the cloud service, you remain responsible for managing user accounts, including creating, managing and removing access. That responsibility cannot be handed to Microsoft.

Onboarding checklist

• HR ticket with start date, role, manager and location, submitted in advance
• Account created with a role-based group set, not copied from another user
• MFA registration completed on day one
• Managed, encrypted laptop enrolled in device management and patched
• Access to business applications approved by the data owner
• Security awareness training and acceptable-use and AI policies acknowledged
• Licenses assigned and recorded

Offboarding checklist

Microsoft's guidance for removing a former employee follows a clear sequence, which is a good backbone for your checklist:

• Block sign-in and revoke active sessions so the person cannot access Microsoft 365
• Preserve mailbox contents if someone is taking over the work or there is a legal need
• Wipe and block mobile devices that hold company data
• Forward email or convert the mailbox to a shared mailbox
• Give a manager access to OneDrive and Outlook data before deletion
• Remove licenses, then delete the account
• Remove access to non-Microsoft systems: ERP, CRM, lab systems, VPN, shared passwords and vendor portals
• Recover laptops and other equipment

Watch the retention clock

Microsoft notes that after you delete an employee's account, the content in their OneDrive and Outlook is retained for 30 days, during which you can restore the account. After that, plan for the data to be gone unless retention policies or backups preserve it. Give the manager access and hand over files before you delete.

For departures involving sensitive data or disputes, consider a legal hold through Microsoft Purview eDiscovery before any deletion.

Make it repeatable

Turn both checklists into standard ticket templates triggered by HR, with each step assigned and recorded. Review a sample of completed tickets periodically and run a regular access review to catch accounts, licenses and shared credentials that were missed.

Remember systems outside Microsoft 365. Departing employees often retain access to SaaS tools, vendor portals and shared passwords that never appear in your directory, which is why an up-to-date application inventory belongs alongside the checklist.

Common follow-up questions

Sources

• Microsoft Learn: Remove a former employee - Overview
• Microsoft Learn: Shared responsibility in the cloud
• Microsoft Learn: OneDrive retention and deletion