Blocking sign-in is not offboarding. An account is only closed when the sign-in is blocked and active sessions are revoked, the licence is reclaimed, the mailbox is converted or delegated, forwarding rules are removed, OneDrive and SharePoint ownership is transferred, and the registered multi-factor authentication methods are cleared. Miss any one of those and the account is still doing something in your tenant.
The visible parts of offboarding almost always happen. The laptop is returned, the HR record is closed, the desk is cleared, and the email signature stops appearing on outgoing mail. The parts that stay open are the ones nobody can see from outside the tenant.
Months after a final day, it is common to find the same account still holding a paid licence, still a member of several Teams, still the sole owner of a SharePoint site that no remaining administrator can manage, still running an inbox rule that forwards to a personal address created years earlier, and still carrying multi-factor authentication registered to a mobile number the organisation does not control.
None of that is exotic. It is the ordinary residue of a process that ended at the HR system rather than at the directory.
A dormant account does not generate failed sign-ins, does not trigger malware detection, and does not appear in a security dashboard as an incident. It is simply an account that has stopped being used, and there is no meaningful difference, from the platform's point of view, between an employee on extended leave and an employee who left in March.
That is why offboarding gaps surface at inconvenient moments: during an audit, during a breach investigation when investigators ask who had access at the time, or during a client's procurement review when someone asks how access is removed.
Unreclaimed licences are the easiest gap to quantify and the least serious. If ten accounts sit licensed for six months after their owners left, the waste is real but recoverable, and the finance conversation is straightforward.
The expensive version is the forwarding rule. An inbox rule that quietly copies mail to an outside address does not stop working when someone resigns, and it is invisible to everyone except an administrator who goes looking. The same applies to a former employee who remains the only owner of a SharePoint site containing contracts, or who still holds a guest invitation into a client's tenant.
Work through these in order. The first two stop access immediately; the rest prevent the account from becoming a problem later.
A shared mailbox under the usual size limit does not need its own licence, which is why converting a departed employee's mailbox is both the tidier and the cheaper outcome. The order matters: convert first, confirm the conversion, then remove the licence. Removing the licence first starts a deletion clock on the mailbox contents, and organisations discover this at the point where the contents are already gone.
In companies of fifteen or thirty people, offboarding is usually a memory rather than a procedure. One person knows which systems the leaver touched, and that knowledge works reliably until the person holding it is the one leaving, or until three people leave in the same quarter.
The fix is not complicated. A written checklist owned by someone other than IT, a quarterly review of accounts that have not signed in for sixty days, and an agreement that licence reclamation is checked against payroll rather than against recollection will catch almost all of it.
Long enough to satisfy your retention obligations and any live matters the correspondence relates to. Converting to a shared mailbox lets you keep it without a licence, so cost is rarely the deciding factor.
Not immediately. Deleting removes the account from view but also removes the audit trail and the ability to recover attached content cleanly. Block, strip access, transfer what matters, and delete on a schedule.
Guest accounts are the most commonly forgotten category, because they were never on the payroll and so never enter the leavers process. Review guest access on its own cycle.
Sign-in activity, last licence assignment date and mailbox activity together give a reliable picture. A review of these across the tenant usually takes less time than organisations expect, and the first run almost always finds something.
If nobody can say with confidence how many accounts in your tenant belong to people who have left, that is the finding, and it is worth resolving before it is discovered by someone else.
Onprem2Cloud IT Solutions Co. is a Microsoft Cloud Solution Provider partner based in Muntinlupa City, working with businesses, local government units and national agencies across Metro Manila and the wider Philippines. We review Microsoft 365 and Azure tenants for dormant and orphaned accounts, unreclaimed licences, forwarding rules, guest access and ownership that has been left behind, and we hand back a findings report ranked by risk rather than volume. You can see the scope of that work on our cybersecurity services page.
Our latest news and trending topics