Microsoft 365 offboarding checklist
The Microsoft 365 leftovers that commonly remain after departures, contractor endings, and role changes: accounts, mailbox access, files, groups, guests, admin roles, and paid licenses. Includes the shared mailbox and license waste checks, since all three problems travel together.
Start with a known departure or role-change list from HR, finance, or operations. Then compare that list against what still exists in Microsoft 365 and Entra ID.
Offboarding leftovers
10 checks- Confirm the user account is disabled or blocked from sign-in when the person no longer needs access.
- Check whether the account still has an assigned Microsoft 365 license and whether that license can be reclaimed.
- Review direct group memberships, Teams access, SharePoint access, and security groups tied to the old role.
- Review shared mailbox delegates, Send As, Send on Behalf, and Full Access permissions left behind after the handoff.
- Transfer or document ownership for OneDrive files, SharePoint content, Teams, groups, Power Automate flows, and operational documents.
- Check whether the former user still owns guest relationships, shared folders, distribution lists, or collaboration spaces.
- Remove admin roles and privileged assignments that were tied to the old job function.
- Review guest users and external collaborators sponsored by the departing person.
- Confirm forwarding, mailbox conversion, retention, and legal hold decisions before deleting or changing mailboxes.
- Document who approved each removal, transfer, or exception so the same question does not return later.
Shared mailbox cleanup
Review shared mailboxes by purpose and owner, not just by display name. A shared mailbox should have a current business owner and a short list of people who still need the access.
Shared mailbox checks
8 checks- Confirm the mailbox has a current owner who can approve access changes.
- Review Full Access delegates and remove former employees, old contractors, and users who changed roles.
- Review Send As and Send on Behalf permissions separately from read access.
- Check whether access is assigned directly or inherited through a group, and confirm the group is still maintained.
- Review forwarding rules, inbox rules, aliases, and external forwarding that could keep data moving after access changes.
- Check whether the mailbox was created from a former user's mailbox and whether ownership, retention, and license decisions were documented.
- Confirm whether the mailbox is tied to Teams, SharePoint, distribution lists, forms, workflows, or customer-facing addresses.
- Document exceptions, especially access retained for finance, legal, HR, or operational continuity.
"We are preparing a mailbox for the user"
This admin center message means Exchange Online is still provisioning the mailbox. It is normal for a few minutes after a license that includes Exchange Online is assigned, after a shared mailbox conversion, or after a migration. If it has not cleared within a few hours, something is usually stuck rather than queued.
If the message will not clear
5 checks- Confirm the assigned license actually includes an Exchange Online plan and that the assignment finished without errors.
- Check for a soft-deleted mailbox or a duplicate proxy address left behind by a previous account with the same email address.
- In hybrid setups, confirm directory sync is healthy and the mailbox attributes coming from on-premises match what Exchange Online expects.
- Check the mailbox from Exchange PowerShell: if it still does not exist hours after licensing, provisioning failed rather than queued.
- If the mailbox was converted from a departing user's mailbox, confirm the conversion completed before any license was removed.
A mailbox stuck in provisioning during a departure or a migration is a mail flow problem, not just a console message. If mail is bouncing or a cutover is stalled, VXSec's infrastructure service handles it as a priority fix.
License waste
Do not remove licenses blindly. First check whether a license is attached to a real current user, a former user, a shared mailbox, an admin account, or an account that owns files, mail, workflows, or business data.
License checks
8 checks- List unassigned licenses and confirm whether they are still needed for upcoming hires or seasonal use.
- Review licensed users with little or no recent activity and confirm whether they are current employees, contractors, or stale accounts.
- Check former employees and contractors for paid licenses that should have been reclaimed during offboarding.
- Review users on higher-tier plans and confirm whether they need the included apps, security features, calling, or compliance capabilities.
- Check shared mailboxes for unnecessary licenses, while preserving licenses required for the actual use case.
- Confirm whether removing a license would affect mailbox access, OneDrive data, Teams access, retention, holds, or workflows.
- Estimate annualized savings only after confirming seat counts, plan names, and billing terms.
- Connect recurring waste back to onboarding and offboarding steps so the same seats do not return next quarter.
When to get help
Get help when the departure list does not match the tenant, when former users still own important files or shared mailboxes, when nobody can explain guest access, or when admin roles and licenses have not been reviewed in months. Those are signs that offboarding has become an access cleanup project, not a one-user task.
VXSec's infrastructure cleanup turns those unknowns into a prioritized cleanup report, with license recommendations tied to cleanup risk.