Offboarding someone properly on their last day
Disabling the account is about a third of the job. The parts people miss are active sessions, the apps outside Microsoft 365, and where the mailbox goes next.
Most offboarding goes wrong in one of two ways. Either it is too slow, and somebody keeps mailbox access for three weeks after they left because nobody told IT. Or it is too fast and too blunt, the account is deleted on the last afternoon, and a month later the finance team needs an invoice thread that no longer exists.
The sequence below avoids both. It takes about half an hour for a standard user, assuming somebody told you the leaving date in advance.
Cut access first, tidy up second
Block sign-in on the account, then revoke sessions and refresh tokens. The second step is the one people skip. Blocking sign-in stops new authentications, but an existing token on a phone can keep working for hours afterwards, so the account is not really closed until you have revoked.
Reset the password afterwards anyway, and remove their registered MFA methods. If the person is later reinstated, or the account is reused, you do not want an authenticator on a phone you no longer control sitting in the authentication methods list.
Decide what happens to the mailbox
Convert it to a shared mailbox and give the manager access. Shared mailboxes under 50GB do not need a license, so you can keep the history and stop paying for the seat, which is usually the outcome everyone wanted without knowing it was available.
Set an automatic reply pointing to whoever is taking over. Forwarding mail to a colleague is the more common choice and the worse one, because the colleague ends up quietly answering as the person who left and external contacts never learn to update their address book.
Their OneDrive is the other half of this. Transfer ownership to the manager before the account is removed, because the default retention window is not generous and files disappear on a schedule most people are not tracking.
The part that actually gets missed
Microsoft 365 is straightforward because it is one console. The gap is everywhere else: the accounting system, the CRM, the design tool somebody signed up for with a company card, the shared logins for the courier portal and the domain registrar, the WhatsApp group with the whole supplier list in it, the building access card.
If any of those use a shared password rather than a named account, that password needs changing on the day, and you will not remember which ones qualify unless somebody wrote it down. This is the argument for keeping a simple list of every service the business pays for and who administers it. Not a project, just a spreadsheet somebody owns.
Check for delegated access too. People accumulate calendar delegation, send-as rights and shared mailbox membership over years, and removing the user does not always remove the permission cleanly.
Devices
A company laptop comes back and gets wiped and re-enrolled. A personal phone with company mail on it needs a selective wipe, which removes the work data and leaves their photos alone. Intune does this properly. Without device management you are relying on the person to delete it themselves, which is a conversation rather than a control.
Then wait before deleting
Keep the disabled account for at least thirty days. It costs nothing once the license is removed and the mailbox is shared, and it covers the request that always arrives in week three.
One process note. Offboarding fails most often because HR and IT are not connected, not because anyone forgot a step. If the leaving date reaches your IT provider on the last afternoon, some of the above cannot be done properly. A standing note to whoever manages the ticket queue, a week ahead, fixes more than any checklist.