Insurers ask how quickly leavers lose access, because an old account that still signs in is an easy way in. It's also one of the most common gaps in small-business tenants: accounts that stay enabled for months because nobody told IT.

Use this checklist on the person's last day, in this order.

On the last day: cut access

  1. Block sign-in for the account in the Microsoft 365 admin center.
  2. Reset the password, so any saved or shared copy stops working.
  3. Revoke sessions in the Microsoft Entra admin center, so signed-in apps and phones are logged out.
  4. Remove their MFA methods, so the old phone can't be used to approve a sign-in later.
  5. Remove admin roles and group memberships, including any Teams they owned.

Mail: hand it over

  1. Convert the mailbox to a shared mailbox if the business needs to keep it. A shared mailbox under 50 GB doesn't need a licence.
  2. Give the manager access, or forward new mail to them.
  3. Set an automatic reply pointing contacts to the right person.
  4. Remove the mailbox from phones and wipe company data from mobile devices.

Files: hand them over

  1. Give the manager access to the person's OneDrive. When the account is deleted, OneDrive is kept for 30 days by default, then removed.
  2. Move anything the business needs into a SharePoint site or team before that happens.
  3. Review links they shared with people outside the company, and remove any that are no longer needed.

Devices and other apps

  1. Collect the laptop and wipe or retire it in Intune, if the client uses it.
  2. Remove access to other apps they signed in to with Microsoft, and to any that use separate passwords.

Afterwards: reclaim and record

  1. Remove the licence once mail and files are handed over, and add it back to the pool or reduce the subscription at renewal.
  2. Delete the account when it's no longer needed. Deleted users can be restored for 30 days.
  3. Note the date access was removed. That's the evidence an insurer asks for.

Catching the ones that slipped through

Even with a good checklist, leavers get missed. Once a quarter, look for enabled accounts with no sign-in for 90 days or more, and confirm each one with the client.

Find accounts nobody uses. The Cyber Insurance Readiness Check lists every enabled account with no recent activity, including ones that were never used.