Someone joins, someone leaves. On paper that is the same set of actions in reverse, yet each side asks for its own approach. Here is how to run both as a single process in Microsoft 365, Microsoft Entra ID and Microsoft Intune, including a checklist you can copy.
Why offboarding slips and onboarding does not
Onboarding has a built-in deadline: someone is waiting for a laptop and a mailbox. If anything is wrong you hear about it within the hour. Offboarding has no such pressure. Nobody calls to report that a former colleague’s account is still active two months later.
That causes three kinds of damage. An active, unused account is a risk, because nobody watches it and nobody rotates its credentials. A licence that stays assigned costs money every month. And a laptop that walked out of the building without being removed from management only shows up when someone starts counting.
The fix is not more discipline. It is fewer separate actions. The more that follows automatically from one change, the smaller the chance something is left behind.
Groups as the foundation: one change, everything follows
Start with the question of where the truth lives. Often that is Entra ID, fed by whatever HR provides. Make sure the fields you steer on are actually filled in: department, job title, location, manager.
Then hang as much as possible off group membership:
- Licences through group-based licensing rather than per person.
- Apps and Intune policies targeted at the same groups.
- Access to SharePoint, Teams and files through groups, not individual permissions.
Dynamic groups based on an attribute work well for broad sets: everyone with a Windows device, everyone in sales. For exceptions, assigned groups are clearer, because you can see who owns them.
The biggest pitfall is the manual exception: a licence assigned directly once, a folder permission tied to a person, a Conditional Access exclusion added “just for now”. Those are invisible on the day someone leaves. Clean them up whenever you run into one, and write down why any remaining exception exists.
Day one: account, licence, device
A new joiner needs three things before they can start: an identity, the right access and a working device.
Identity and first sign-in
Create the account with every attribute filled in, put it in the right groups, and decide how the first sign-in works. A Temporary Access Pass in Entra ID beats reading a password down the phone: the new joiner registers an authentication method immediately and you never share a password.
Rolling out the device
For Windows there are two routes side by side: classic Windows Autopilot and Windows Autopilot device preparation. The first works with hardware hashes and pre-registered devices, the second with a policy applied during provisioning, optionally combined since 27 August 2026 with device association, which binds a Windows 11 device to your organisation before enrolment. Microsoft publishes guidance on moving between them and maintains a separate page listing changes in device preparation. Microsoft now calls device preparation the recommended solution for eligible user-driven Microsoft Entra join scenarios and is focusing further engineering there, while both can coexist in one organisation. Check the current requirements in that documentation before you commit hundreds of devices to one approach.
Record the handover
Write down which device went to whom, including the serial number. It sounds like paperwork, but it is exactly the information you need when that person leaves. For checks like this I built Deskside: scan the serial number of a laptop or phone and see its status in Autopilot, Intune and Entra ID right away, with checklists and PDF handover documents.
The baseline policy set
A new device should not just run, it should also fall within the rules. Keep the baseline small and consistent:
- Compliance policy: disk encryption, minimum OS version, antivirus active, screen lock.
- Conditional Access: access to company data only from a compliant or hybrid-joined device, with strong authentication.
- App protection policies for phones, so company data stays inside managed apps, including on personal devices.
- Update policy: rings for Windows updates and an agreement on how long deferral may last.
- Local administrator password managed centrally instead of one shared password.
Use fixed naming for policies and groups, with a prefix for platform and audience. A year from now you want to see in three seconds what something does and who it targets. New options keep landing in What’s new in Microsoft Intune; it is updated weekly, so check it regularly and you never have to catch up.
Role changes: the step everyone skips
Internal moves are easily overlooked. Someone moves from the service desk to finance and keeps all their old access, because nobody removes it. After a few moves that access keeps piling up.
So treat a role change as a leave plus a join. Remove the old groups on the date the new role starts, not “once the handover is done”. If you need an overlap, agree on an end date. On top of that, review the most privileged groups periodically: who is in them, and why.
The last working day: order matters
Work from the outside in. Close access first, clean up afterwards.
- Block sign-in in Entra ID.
- Revoke sessions. This invalidates refresh tokens, so no new access tokens are issued. Allow for a short window in which an already issued token still works.
- Reset the password and remove registered authentication methods.
- Remove from groups. Apps, policies and access all drop away in one move; leave the group that assigns the licence in place for now, because mail and files still need handing over.
- Handle the device. A returned corporate device can be wiped or reprovisioned for the next user; for a personal device, use the action that removes company data only. Afterwards, update the records in Autopilot, Intune and Entra ID so the inventory matches reality.
- External services that do not run through Entra ID need manual attention. Keep a list, otherwise you forget one every time.
Do not delete the account straight away. While it is blocked and its sessions are revoked nobody can sign in with it, and you keep the option to retrieve something or investigate later.
After that: mailbox, files and licence
This part can happen calmly, but within an agreed deadline.
- Mailbox: give the manager access or convert it to a shared mailbox. A shared mailbox needs no licence by default, but does above a certain size; check the current limit in Microsoft’s documentation.
- OneDrive: assign a secondary owner or move the files to a team location before the account disappears. Once the account is deleted a retention period starts, after which the content is gone for good.
- Teams and SharePoint: check where this person was the only owner. An ownerless group does not announce itself and causes trouble later.
- Licence: release it once mail and files are sorted, and record the date. This is where monthly costs quietly keep running.
Checklist
Joiner
- Account created with department, job title, location and manager filled in
- In the right groups; licence and policies follow from that
- First sign-in arranged, authentication method registered
- Device provisioned through your chosen Autopilot route, serial number recorded
- Compliance, Conditional Access and update policy applied to the device
Mover
- New groups added, old ones removed on the effective date
- Individual permissions and mailbox delegations reviewed
Leaver
- Sign-in blocked, sessions revoked, password reset
- Removed from all groups
- Device wiped or company data removed, records updated
- External services outside Entra ID updated
- Mailbox and OneDrive handed over, group ownership checked
- Licence released and the account deleted after the agreed period
Put these steps on a single page and give them one owner. If your process is currently a set of loose actions, I am happy to look at it with you during a half-hour intro call; setting up Microsoft 365, Intune and Entra ID is part of IT consultancy.
Frequently asked questions
- Should I delete a leaver's account immediately?
- No. Block sign-in and revoke sessions first. Delete the account only after mail, files and group ownership have been handed over, and agree on a fixed waiting period for that.
- What do I do with a personal phone that was used for work?
- Use the action that removes company data only, combined with app protection policies. Personal files and apps stay in place while company data disappears from the managed apps.
- Should I move from classic Windows Autopilot to Autopilot device preparation?
- That depends on your situation and on what device preparation currently supports. Microsoft publishes migration guidance and a separate change log; check both before you commit to a provisioning method.
- How do I stop licences from running on unnecessarily?
- Assign licences through groups rather than per person, and make group removal a fixed step on the last working day. Also review periodically which blocked accounts still hold a licence.
