Microsoft 365 Joiner and Leaver Controls for SMEs

A new employee needs enough access to become productive. A departing employee creates a different challenge: access must end at the authorised time while the organisation retains the information and responsibilities it still needs. Both transitions become difficult when the process depends on informal messages and one administrator’s memory.

Microsoft 365 joiner and leaver controls connect people decisions with technical actions. HR or management confirms the employment event, business owners approve access and information handover, and IT performs and verifies the changes. A small business can make this process reliable without creating a large administrative system.

The guidance here focuses on planning and accountability. Microsoft 365 capabilities vary by subscription, tenant configuration, assigned roles and identity architecture. Check the current documentation for your environment before making changes, especially where retention, shared mailboxes or synchronised identities are involved.

Use one request to establish the facts

A joiner request should identify the employee, manager, start date, location, role and equipment needs. Include the services required for the job and the owners who can approve access. Avoid using an existing employee’s account as the specification for the new one.

A leaver request needs an authorised effective time, the person coordinating the transition and the owners responsible for ongoing work. Distinguish a planned departure from an urgent access restriction. The same checklist can support both, but the sequence and communication may differ.

Verify identity carefully. Similar names, contractors with multiple engagements and employees who have changed departments can create ambiguity. Use the organisation’s approved identifiers and confirm the exact account before changing access or transferring information.

Keep the request in a controlled location with a clear audit trail. Sensitive employment details should only be available to the people who need them. The operational checklist can refer to the authorised decision without distributing unnecessary personal information.

Define access by role and business purpose

Create a small set of access profiles for recurring roles. Each should describe the groups, shared resources and applications normally required, with an owner for approval. Treat the profile as a starting point that is reviewed when responsibilities change.

Separate basic collaboration access from privileged administration. A new employee who needs to work with departmental documents should not receive broad tenant permissions simply because a manager wants them to help with occasional support tasks. Any elevated role needs its own justification and review.

Identify access outside Microsoft 365 as well. A staff member may use a finance application, remote access service, supplier portal or shared local storage. The Microsoft 365 checklist should connect to those systems rather than creating the impression that the whole employment transition ends at the tenant boundary.

For contractors and temporary staff, record the expected end date and sponsor. The sponsor should confirm extensions before access continues. An account that remains active because nobody knew the engagement ended is a process gap, not merely an administrative oversight.

Make the first working day a validation event

Prepare the account, approved services and device before the employee arrives, following the organisation’s authentication and device policies. Deliver initial access through the approved secure process rather than sending credentials into an uncontrolled conversation.

Test the employee’s actual workflow with them. Can they sign in using the expected method, reach the documents they need, send an authorised message and access the relevant business application? Record missing access as a specific request with an owner.

Confirm that restricted resources remain restricted. A positive test proves that necessary access works; a negative test helps detect an overly broad role assignment. Use controlled examples and avoid exposing confidential material during onboarding.

Explain where business information belongs. If the employee starts storing team records in a personal working area without an ownership plan, a future departure becomes harder. A short orientation on shared resources and support channels prevents confusion that account creation alone cannot address.

Plan the leaver’s work handover before changing data

Ask the manager to identify active projects, customer commitments, shared responsibilities and important documents. Determine which information belongs in a team-managed location and who will become accountable for it. Do not assume that all useful work is contained in the employee’s mailbox.

Agree how future correspondence will be handled. The business may need a continuing contact route, a replacement owner or an appropriate automatic response. These are business decisions that should be made deliberately rather than inferred from the available console options.

Microsoft’s former-employee overview separates access prevention, information preservation, mailbox handling, document access, licensing and account deletion. That separation is a useful reminder that no single action completes every part of offboarding.

Where legal, contractual or records obligations may apply, have the responsible owner decide the required treatment before deletion or licence changes. The administrator should implement an approved decision using the applicable capabilities, not guess the organisation’s retention obligations.

Separate access removal from account deletion

The immediate requirement may be to prevent further access while preserving information for authorised review. Deletion is a different lifecycle action and should follow the approved plan. Record the required timing and verify the result through the supported procedures for the tenant.

Consider sessions, devices and connected applications as part of the access review. Do not assume that changing one setting instantly resolves every access route. The technical team should follow the current Microsoft instructions applicable to the identity model and services involved.

For synchronised environments, establish where the identity is managed. Microsoft’s account deletion guidance identifies additional considerations for accounts synchronised from local Active Directory. The same page cautions against deleting the account that anchors forwarding or a converted shared mailbox.

Maintain a timed record of actions and verification. If a change is pending or cannot be confirmed, report that state explicitly to the authorised owner. A checked box should represent evidence of completion, not merely an instruction sent to someone else.

Give mailbox decisions their own approval

A mailbox can contain customer history, internal discussions and personal material. Decide who genuinely needs access and for what purpose. Broad access for convenience may be unnecessary when a narrower handover can meet the business need.

Microsoft’s mailbox conversion guidance describes forwarding and shared-mailbox options for former employees. Confirm the current requirements and limits for the chosen option, including licensing where applicable, instead of assuming every mailbox can be handled identically.

Set a review date for any continuing arrangement. A mailbox or forwarding rule created during a departure can otherwise become a permanent, unexamined part of the environment. Assign an owner who can decide when the arrangement is no longer required.

Test the approved outcome without impersonating the former employee. Confirm that authorised recipients can perform the intended work and that incoming correspondence follows the agreed route. Record what was tested and any limitation still awaiting resolution.

Transfer document responsibility with the business owner

Identify important working files and the people who need them. The handover should preserve context: project status, approved versions, outstanding decisions and any external collaborators. Simply copying a large folder can move data while losing the explanation that makes it useful.

Microsoft provides guidance on giving another employee access to OneDrive and Outlook data. Use the procedure appropriate to the tenant, and verify the applicable retention settings rather than relying on a remembered default period.

Have the receiving owner confirm the result. They should be able to find representative documents, understand where ongoing work will continue and identify any gaps. IT can verify technical access, but the department must judge whether the business handover is complete.

Review shared links, group membership and externally shared material within the agreed scope. A staff transition is an opportunity to confirm continuing ownership, not an instruction to revoke every collaboration relationship without considering its purpose.

Reconcile equipment, subscriptions and remaining accounts

Track returned devices and the approved process for handling company information on them. Coordinate with the responsible device-management team and distinguish company-owned from personally owned equipment. Any remote action must follow the organisation’s authority and the capabilities actually deployed.

Review licence assignment after the information and service decisions have been made. Confirm the effect of a proposed change against current Microsoft guidance and the tenant’s requirements. Cost cleanup should not precede a necessary preservation decision.

Check shared credentials and non-personal responsibilities. If the employee knew a departmental password or maintained an integration, the organisation may need a separate transition. Do not simply give the next employee the same undocumented arrangement.

Close the request only when outstanding items have owners. A missing laptop, unreviewed document collection or unresolved external application account should remain visible. Completion can be qualified, but it should not conceal unfinished work.

Keep the process proportionate and repeatable

Review a sample of completed joiner and leaver requests periodically. Look for late notifications, unnecessary privileges, missing handover approvals and tasks that repeatedly depend on one person. Improve the checklist around observed problems rather than adding steps without a purpose.

Maxicon’s IT support contracts are a relevant starting point for discussing ongoing administration responsibilities and escalation arrangements. For a review of your staff transition process, contact Maxicon with your identity model, current checklist and the gaps you want to resolve.

Frequently asked questions

Can we give a new employee the previous employee’s account?

Create and manage an individual identity through the approved process instead. Reusing an identity can confuse accountability and carry forward access that the new role does not require. Transfer business responsibilities and approved information deliberately, while keeping the account lifecycle and access approvals attributable to the correct person.

Is removing a licence enough to offboard someone?

Treat licensing, access restriction, information preservation and account deletion as separate decisions. Follow the current Microsoft procedure for the tenant and verify the required access outcome. A licence change should not be used as a substitute for a complete leaver process or made before the business has decided how required information will be handled.

Should every departing employee’s mailbox become a shared mailbox?

No. Choose the arrangement that meets the approved business need and applicable requirements. Some roles need continuing correspondence handling; others require a different preservation or closure approach. Confirm eligibility, limits and licensing for the selected option, assign an owner and set a review date so the arrangement does not remain indefinitely by default.

Who confirms that document handover is complete?

The receiving business owner should confirm that the necessary information is available and understandable. IT verifies the technical access and performs approved changes. Both checks matter: a technically accessible folder may still omit critical working context, while a good handover description is not useful if the recipient cannot open the files.

How should role changes be handled?

Treat a transfer as an access review, not just an addition of new permissions. Confirm the new responsibilities, grant approved access and remove access that no longer has a business purpose. Review ongoing project exceptions with their owners so the employee retains only the access required for their current work.

Related technology support

For an additional service perspective related to this guide, explore Trubyte’s cloud and collaboration services.