offboarding-sop.txt

Employee offboarding SOP for MSPs

The standard operating procedure for a leaver ticket, in the order that keeps the client's data and access safe. Copy it into your PSA as a ticket template.

Offboarding goes wrong in two ways. Access stays open because a session, an app password, or a phone kept working after the password reset. Or data gets lost because the licence was removed before the mailbox was converted to shared, which starts Microsoft's 30 day countdown to deleting it. This SOP puts the steps in the order that avoids both.

Run section 2 at the agreed time: the end of the last working day for a planned leaver, straight away for a dismissal. Everything after it can happen the same day. Record each client's choices (who gets the mail, who gets the files, how long to keep the account) in their documentation so the next leaver follows the same answers. For new starters, use the new user onboarding checklist.

Template: employee offboarding SOP

1. Request and approval

  • Ticket logged against the right client company, with the requester as the contact
  • Requester is on the client's approver list; confirm by phone or in Teams before acting on an email-only request
  • Leaver's name, username, last working day, and the time access should end
  • Planned leaver or immediate removal (dismissals run section 2 now, before the user is told)
  • Who receives the mailbox: shared mailbox access, forwarding, or both, and the auto-reply text
  • Who receives OneDrive files and ownership of any Teams or SharePoint sites
  • Whether a legal or litigation hold applies
  • Device return arranged, with the collection date noted on the ticket

2. Revoke access

  • Sign-in blocked in Entra ID (and the account disabled in on-prem AD for hybrid tenants)
  • All active sessions revoked, so open Outlook, Teams, and browser sessions end now
  • Password reset to a random value nobody keeps
  • MFA methods removed and any app passwords deleted
  • Admin roles and privileged access removed
  • Company data wiped from phones through Intune (a selective wipe on personal devices)
  • VPN, remote access, and SSO app access removed; line-of-business app accounts disabled
  • Shared passwords the user knew rotated, including any in a shared password vault

3. Mailbox

  • Mailbox converted to shared before any licence is removed
  • Mailbox size checked: a shared mailbox over 50 GB, or one under litigation hold, still needs a licence
  • Full Access granted to the manager or the named recipient
  • Forwarding or an auto-reply set, as the client asked
  • Hidden from the global address list

4. Files and ownership

  • OneDrive access granted to the manager, with the retention period noted (30 days by default after the account is deleted)
  • Ownership of Teams, Microsoft 365 groups, and SharePoint sites moved to another user
  • Litigation hold or retention policy applied, if required

5. Groups and licences

  • Group and distribution list memberships recorded on the ticket, then removed
  • Licences removed, after the mailbox conversion in section 3 is confirmed
  • Seat count reduced with the distributor, if the client does not need the seat for a new starter
  • Seats freed in other per-user tools (EDR, backup, password manager, line-of-business apps)

6. Devices

  • Laptop and phone collected, and the asset record updated
  • Device wiped or reset through Intune, or reimaged to the client's standard
  • BitLocker recovery key kept until the wipe is confirmed
  • Device retired or reassigned in the RMM and EDR consoles

7. Closeout

  • User marked inactive in IT Glue or Hudu
  • PSA contact set to inactive (kept, so the ticket history stays attached)
  • Every action and its time listed in the ticket notes, time entry logged
  • Confirmation sent to the requester, listing where the mail and files now live
  • Follow-up ticket scheduled to delete the account once the client's retention period ends

Rallied is an AI agent that resolves requests in your PSA, and it runs the Microsoft 365 part of this SOP from the leaver ticket: sign-in blocked, sessions revoked, password reset, licence freed, groups removed, mailbox converted to shared, and mail forwarded to the manager, with each planned change written on the ticket first. See Microsoft 365 automation.