Microsoft 365 與 Google Workspace 離職處理清單模板列明同日步驟

Free download: IT offboarding checklist (free template). It's ordered for urgent exits; for a planned exit, do the transfer steps first. Copy it, then use the steps below to fill it in. I make these templates.

Offboarding gaps are rarely clever. An account stayed active, a phone kept syncing mail, or a shared password never changed. A short checklist that runs in the same order every time closes those gaps, and it leaves a dated record you can show if an auditor, insurer or customer asks.

This guide covers what to do before, on and after the last day in Microsoft 365 and Google Workspace.

Order matters: transfer, then cut, then clean up

If you disable an account first, you can lose access to the files, mailbox and app ownership you still need. If you wait too long, the person keeps access. Use this order:

1. Inventory what they can reach (identity, SaaS, devices, shared secrets).
2. Transfer data and ownership you need to keep.
3. Cut access at a set time, with sessions revoked.
4. Clean up licenses, devices, and shared credentials, and record evidence.

For a hostile or high-risk exit, swap steps 2 and 3. Cut access first and recover data as an admin afterward.

Before the last day (T-5 to T-1)

• Get the exit date and time from HR in writing, and say whether it is planned or immediate.
• List every system the person uses. Start with the identity provider's app assignments, then ask their manager about anything outside SSO: payroll, banking, the domain registrar, social accounts, vendor portals.
• Find what they own: shared drives, Teams or Groups, calendars, scheduled flows or Apps Script, forms, and any OAuth apps they authorized.
• Note shared credentials they knew (Wi-Fi, alarm codes, password-manager shared folders) so you can rotate them.
• Arrange device return and decide whether to keep or wipe each device.

On the last day: Microsoft 365

1. Reset the password and choose Sign out of all sessions (Microsoft 365 admin center > Users > Active users > select user). Microsoft notes that blocking sign-in can take time to take effect, so resetting the password is the fast step (Microsoft Learn).
2. Block sign-in on the same user page.
3. Revoke refresh tokens if you script it: Revoke-EntraUserAllRefreshToken and Set-EntraUser -AccountEnabled $false (Microsoft Learn).
4. Remove MFA methods and registered devices so a cached authenticator can't be reused.
5. Convert the mailbox to shared or set forwarding to the manager, and add an auto-reply if customers email this person.
6. Transfer OneDrive access to the manager before the license is removed. Deleted users' OneDrive has a retention window, so don't leave this for later.
7. Remove the user from groups, Teams ownership and admin roles.
8. Wipe or retire devices in Intune, or collect them.

On the last day: Google Workspace

Google's own checklist covers the core steps (Google Workspace Admin Help):

1. Change the password and reset sign-in cookies (Admin console > Directory > Users > select user > Security).
2. Revoke app passwords, security keys and OAuth tokens on the same Security panel.
3. Remove recovery email and phone so password recovery can't be used.
4. Suspend the user while you transfer data.
5. Transfer Drive and Calendar ownership (Admin console > Account > Data transfer), then delete the account or keep it as an archived user.
6. Wipe or remove the account from managed mobile devices.

Everything outside SSO

This is where most gaps live. For each app on your inventory, record who removed the account, when, and how you checked it. Pay special attention to:

• Finance: bank portals, payment processors, expense tools
• Your domain registrar and DNS host
• Social media and ad accounts
• Shared password-manager folders (rotate any secret they could see)
• API keys, service accounts and automation they created

After the last day (T+1 to T+30)

• Check sign-in logs for the account over the following week.
• Remove licenses once data transfer is confirmed.
• Close out the ticket with evidence: screenshots or log extracts of disabled accounts, device wipe confirmations, and the list of rotated credentials.
• Add anything you missed to the template so the next offboarding is faster.

Make it repeatable

A one-off list helps once. A template that HR starts and IT completes helps every time. Copy the checklist into your ticketing system or a shared doc and give each step a named owner, so HR can start it and IT can finish it the same way every time.

Common mistakes

• Disabling before transferring files, mailbox or automation ownership.
• Forgetting sessions. A password reset without session revocation leaves signed-in apps working.
• No owner for non-SSO apps. Assign each one to a named person with a deadline.
• No record. If you can't show what was done and when, it didn't happen as far as an auditor is concerned.

This is general guidance. Check your own legal, HR and data-retention requirements before deleting accounts or data.

Drafted with AI assistance and reviewed for accuracy.

Not affiliated with, endorsed by, or sponsored by Microsoft or Google. Microsoft 365, Entra and Intune are trademarks of Microsoft; Google Workspace is a trademark of Google LLC.