Offboarding runbook
- 1
Block sign-in and end sessions
The person is signed out everywhere straight away.
- 2
Remove sign-in methods
Registered MFA methods are removed so a known phone can't be used to get back in.
- 3
Keep the mailbox
Convert it to a shared mailbox, give their manager access and set forwarding or an automatic reply.
- 4
Hand over files
Give the manager access to their OneDrive before it's removed.
- 5
Free the license
Remove licenses once the mailbox is converted, so you stop paying for them.
Onboarding runbook
Create the account, assign the right license, add the person to groups and require MFA at first sign-in. Every step is recorded with who ran it.
Safety
Offboarding is disruptive, so TenantWard asks you to type the person's email to confirm, backs up their settings first and keeps an undo for each step. Teams can require a second approver.
Questions
- Does offboarding delete the user?
- No. Deleting accounts is a restricted change and never one-click. The runbook blocks access, preserves mail and files, and frees the license.
See where your company stands
Check a domain for free, then connect Microsoft 365 or Google Workspace for the full checkup. Every new workspace gets a 7-day trial, no card needed.