An employment agency Microsoft 365 offboarding checklist should preserve business-owned email and candidate documents while removing the departing person’s ability to sign in, use active sessions or retain access through shared resources. The sequence matters. Disabling an account too early can strand work; transferring files but leaving sessions active can leave an avoidable access path.
This guide is for Singapore employment-agency owners and operations managers. It is operational guidance, not legal advice. HR and management should approve the timing, data handling and communication before IT acts.
Why is employment-agency offboarding different?
Consultants may work across individual mailboxes, shared inboxes, OneDrive folders, SharePoint libraries, Teams chats, calendars, job portals and client-managed systems. Candidate documents can be attached to email, saved under one employee’s account or shared through links that outlive the account.
A useful offboarding process does four jobs: preserves work the agency owns, transfers operational responsibility, revokes every access path that should end, and produces evidence that the intended state was reached.
1. Open one approved offboarding record
Use a unique record containing the employee, role, manager, last working time with timezone, account identifiers, managed devices, business systems, active case owners, shared mailboxes, relevant document locations, client portals and the people who must verify completion.
Do not include passwords, recovery codes or unnecessary candidate information. Link to controlled systems by reference.
2. Decide the access cut-off before technical work starts
Management should state whether access ends at a planned time, immediately, or in stages. IT should not infer this from an informal chat message. The record should show who approved the cut-off and who may change it.
For an urgent security concern, use the incident process. Keep containment, employment decisions and external communications with the authorised people responsible for them.
3. Inventory work that needs a new owner
Ask the manager to identify active employer accounts, candidate cases, interview schedules, offers awaiting action, shared-inbox conversations, document folders, recurring meetings, automation ownership and supplier relationships.
For each item, name the receiving owner and the verification test. “Transfer everything to the team” is not specific enough. The receiving consultant should be able to open the actual case location, see the current version and understand the next action.
4. Separate personal mailbox work from shared mailbox work
Microsoft describes a shared mailbox as a common address that authorised members can monitor and send from. Review which agency functions should live in shared mailboxes such as enquiries, placements or operations rather than an individual account.
Check Full Access separately from Send As and Send on Behalf. These permissions do different jobs. Grant only what the receiving person needs, confirm the shared mailbox still has a business owner, and remove the departing user’s delegation.
5. Preserve business email deliberately
Management should decide whether another authorised employee needs access to the former employee’s mailbox, whether messages should be forwarded or whether the mailbox should be converted for controlled continuity. Follow the current Microsoft 365 procedure for the tenant and licence state.
Do not create indefinite forwarding by habit. Record the destination, purpose, owner, review date and removal condition. Review automatic replies so they provide a business contact without disclosing unnecessary details about the departure.
6. Transfer OneDrive and SharePoint responsibility
Identify business files in the employee’s OneDrive, especially candidate packs, client submissions, templates and active-case documents. Move or grant access to an approved business location and receiving owner before deletion decisions.
Microsoft’s offboarding guidance distinguishes account blocking, mailbox handling, OneDrive access, licence removal and account deletion as separate steps. Treat them separately rather than assuming one button completes the job.
For SharePoint, verify site membership, group membership, direct permissions and externally shared links. Removing the employee does not automatically decide whether every external recipient should retain access.
7. Review candidate-document sharing links
List the SharePoint and OneDrive locations used for candidate documents. Review links by owner, recipient, scope, expiry and business purpose. Delete links that are no longer needed and replace broad or anonymous sharing with named access where practical.
Microsoft notes that external sharing is controlled at both organisation and site level, with the more restrictive setting applying. This means the correct review needs both the local item and the wider sharing design.
8. Reassign Teams, groups and calendars
Check Microsoft 365 groups, Teams memberships, private channels, shared calendars, meeting ownership and recurring interviews. Remove the departing user, add the correct successor and verify that at least two appropriate owners remain for critical teams or groups.
Do not make every manager a global administrator to solve ownership. Business ownership and tenant administration are separate responsibilities.
9. Revoke sign-in and active sessions
At the approved cut-off, block sign-in and use the supported administrative controls to revoke active sessions. Review registered authentication methods, delegated applications, app passwords if any, and any device-management state relevant to the user.
A password reset alone is not a complete revocation plan. Existing sessions, mobile access, application grants and external systems may have separate controls.
10. Remove privileged and delegated access
Check Microsoft Entra roles, Exchange roles, SharePoint roles, security groups, administrative units, service-management consoles, password-manager collections and vendor portals. Record the before and after state for anything privileged.
If the user owned an automation, service account or connector, transfer ownership and credentials through a controlled process. Do not convert a personal user account into a permanent machine identity.
11. Recover and verify managed devices
Match laptops, phones, security keys, tokens and accessories to the asset register. Confirm that company data is protected through the approved device-management and encryption design. Remote wipe or retire actions should follow management approval and the actual ownership model.
Before reassignment, preserve approved business files, rebuild the device to the standard baseline and test sign-in with the new user. Do not create a new profile over the old one and call the device clean.
12. Remove licences in the right sequence
Licence removal should follow the agency’s decisions about mailbox access, retention and data transfer. Microsoft documents different consequences and timelines depending on whether the account, licence and data are removed. Check the current Microsoft guidance and the tenant’s retention configuration immediately before action.
Keep licence recovery as a final administrative step, not the opening move. Saving a licence is not worth stranding an active case.
13. Verify external systems outside Microsoft 365
Review applicant tracking, job portals, assessment platforms, client portals, telephony, WhatsApp Business or other approved messaging, e-signature, finance, CRM and vendor support tools. Use named accounts where available.
For each system, verify disablement, ownership transfer, shared credentials, API tokens, connected apps and recovery contacts. Microsoft 365 offboarding cannot remove access from a separate supplier automatically unless a tested integration does so.
14. Run a two-person completion check
IT verifies the technical state: sign-in blocked, sessions revoked, roles and groups changed, mailbox and file access transferred, licences handled, devices accounted for and exceptions recorded. The manager verifies the business state: active cases have owners, shared channels work, important documents open and communications have a responsible person.
Keep unresolved items open. A missing client-portal owner or inaccessible candidate folder should not disappear inside a completed ticket.
Employment agency Microsoft 365 offboarding checklist
- The cut-off time and approver are recorded.
- Every active case and employer relationship has a receiving owner.
- Shared-mailbox permissions are reviewed by permission type.
- Mailbox continuity has an owner and review date.
- OneDrive and SharePoint files are transferred and opened by the successor.
- External sharing links are reviewed, not assumed.
- Teams, groups, calendars and meetings have the right owners.
- Sign-in and active sessions are revoked at the approved time.
- Privileged roles, app grants and external systems are checked.
- Managed devices are recovered or handled through the approved process.
- Licence removal follows data and mailbox decisions.
- IT and the business both verify completion.
Questions to ask your IT provider
- Can you show the exact offboarding sequence for our Microsoft 365 tenant?
- How do you discover shared-mailbox delegation and external sharing?
- What evidence confirms active sessions and privileged access were removed?
- How do you transfer OneDrive and automation ownership without creating a second uncontrolled copy?
- Which non-Microsoft systems must remain on our checklist?
- How are exceptions assigned, tracked and closed?
Build offboarding into normal operations
A managed IT process should connect HR approval, identity administration, endpoint management, shared mailbox ownership, file transfer and verification. It should be repeatable without turning every departure into an emergency.
Review Sakal Network’s managed IT services and managed cybersecurity services. For licence options, browse Microsoft 365 plans on Sakal Shop, or contact Sakal Network to map an offboarding workflow for your agency.