Ex-Staff Are Still in Your SharePoint: the Offboarding Checklist

Ex-staff are still in your SharePoint: the offboarding audit checklist

The scenario is almost universal in small firms. Someone left, amicably, usually, six or eight months ago. The laptop came back, the standing order got cancelled, the email forwarding was sorted. And somewhere in your Microsoft 365 tenant, their name is still on things: a Teams group where they're "still a member", a SharePoint folder they personally shared with a client, an Anyone-link to the payroll folder they made once because it was quicker than attaching.

This is a checklist, not a lecture. Budget 60–90 minutes the first time. Every step is verified against Microsoft's own documentation, current as of 3 September 2026.

First: know what "gone" actually means

Three facts that change how you read this audit:

1. Disabling an account is not instant eviction. Entra access tokens last an hour by default; after you revoke, sessions die "when the access token expires", and apps that don't support continuous access evaluation can hold sessions longer (Microsoft Learn: Revoke user access in Microsoft Entra ID, accessed 3 September 2026). Block sign-in and hit Revoke sessions.
2. Deleting a user starts a 30-day countdown. Their OneDrive and mailbox content is retained for 30 days, then deleted permanently (Overview: Remove a former employee, accessed 3 September 2026). If you've already deleted them more than a month ago, that data is gone, and if they left shared links to it, those links now point at nothing while copies live in the recipient's tenant.
3. SharePoint "Anyone" links don't know anyone left. Per Microsoft's external sharing overview, to stop sharing with anyone-link holders you must "go to the file or folder that you shared and delete the link". Removing the person from Entra does not kill links they created (Overview of external sharing in SharePoint and OneDrive, accessed 3 September 2026). And external sharing is on by default for the whole tenant.

The checklist

Identities

• [ ] In the Microsoft 365 admin centre, review Users → Active users against your actual payroll. Every ex-employee still "Active" is a live credential, even one that "doesn't remember the password".
• [ ] For anyone still needed for data: Block sign-in, then Revoke sessions in Entra (Entra admin centre → user's Overview page). Both, not either.
• [ ] Check for guest accounts (Entra → Users → External Identities → Guest users). A personal Outlook.com address you invited in 2023 is an ex-employee with a side door.
• [ ] Deleted-but-not-hard-deleted users: confirm the 30-day window and restore-then-save anything important before it purges.

Mail

• [ ] Convert the leaver's mailbox to a shared mailbox: no licence needed up to 50 GB, so the seat frees up while client email keeps landing somewhere sane (Microsoft's step 4 in the remove-former-employee series, 50 GB rule per the convert-a-user-mailbox doc, accessed 3 September 2026). Or set email forwarding to whoever inherited the client.
• [ ] Check mobile partnerships / devices for the old phone still receiving mail, and remove them (step 3 wipes or blocks devices where Intune manages them; where it doesn't, the best you can do is stop access).
• [ ] Calendar: cancel or reassign meetings in the old account's name so clients aren't meeting a ghost.

Files (the part people skip)

• [ ] Their OneDrive: before deletion, create the "link to files" under the OneDrive tab in the admin centre and move what the firm needs into a proper SharePoint library (step 5). Files in a personal OneDrive are one resignation away from being someone's property.
• [ ] SharePoint site permissions: open each team site → Permissions → "All sharing" (or the Site permissions info panel). Look for the leaver's name and any external shares they made. These survive their deletion.
• [ ] Link inventory on sensitive libraries: search for "Anyone" links on finance/HR document libraries and remove or expiry-set them.
• [ ] Teams: remove them from every team and channel (membership follows the Microsoft 365 group; removing the user from Entra doesn't always scrub chat history references, but it does end access).

Keys to the kingdom

• [ ] Did they hold admin roles? Entra → User → Assigned roles. Global Administrator, User Administrator, SharePoint Administrator, Exchange Administrator. Audit every account, not just leavers.
• [ ] Search for Service Principals / app registrations they created (Entra → App registrations → owners). The integration they built for the 2024 quote tool dies silently with them unless ownership moves.
• [ ] Their MFA methods (phone, authenticator): a leaver's registered authenticator app on a phone they kept is still, technically, a factor. Reset registration with the account block.
• [ ] Password managers / shared browser profiles: anything with a saved Microsoft login on a machine you didn't reclaim.

How the other half lives: onboarding

The same tenant creates most of these messes by omission. A clean joiner process, with a named owner, MFA registered day one, standard groups and a licence chosen on purpose (see the licence stack post), means the leaving process is a checklist instead of an archaeology dig.

Every quarter, without fail

Run the identity and files sections even when nobody has left. Leaver drift is the visible bug; guest and Anyone-link sprawl is the invisible one. And when the audit finds something, write down the fix while you're in the portal. That document is your offboarding SOP. Count the hours this whole exercise eats if it lands on your accidental IT person, and you'll see what that arrangement costs.

If you'd rather this was someone else's recurring job, audited, fixed, and reported monthly with the rest of your M365, that's exactly what our support covers: apxdigital.io/it-support.

---

APX Digital: remote-first M365 support for small firms. Birmingham / Coventry / West Midlands.

Info@apxdigital.io · 07753 226214