The person who ran your IT has left. Start with what was in their name.
They set up the email, the Wi-Fi, and the backups, and everything kept working. On the last day the laptop came back and the keys were handed in, and that felt like the end of it. For daily work, it mostly is.
The boundary is that accounts, alerts, and renewals are attached to a name or an address, and nothing moves when a person leaves. This is a sequence for the first seven days, whether the person was an employee or a contractor. It works the same on good terms or bad.
Day one: close the sign-in, keep the account
Microsoft’s guide to removing a former employee starts with preventing sign-in, and only later gets to deleting the account. Follow that order. Deleting stops mail sent to the address from arriving, and content is kept for only 30 days afterward. If you remove the license but leave the account, Microsoft says the mailbox, contacts, and calendar are kept for 30 days and then deleted permanently.
- Sign in to the Microsoft Entra admin center with an administrator account. Go to Entra ID, then Users, then All users, and select the person.
- Under Account status, select Edit, clear Account enabled, and save.
- On the user’s Overview page, select Revoke sessions.
- If the person was an administrator, check first that two other people at your company hold the Global Administrator role. Microsoft says disabling an administrator account takes the Privileged Authentication Administrator role.
Why signing out isn’t instant
Microsoft notes that access tokens last 1 hour by default. Browser-based apps often keep their own session, and Microsoft says the app itself has to end it. So a person can stay signed in to some apps after the account is disabled, until the app notices. List the apps the person used, such as the accounting system and the remote support console, and remove their login in each one.
Days one and two: what ran in their name
Most of what breaks after a departure is something that sent a message to one address, or lived in one person’s account. Check each place and write down the name now on it.
- Alert and report mail. Backup results, update reports, and security notices may all go to their address. Microsoft’s removal steps let you forward the mailbox or convert it to a shared mailbox, so nothing bounces while you re-point the senders.
- Shared mailboxes and groups. Note any they owned or were the only member of.
- Remote support tools. CISA tells organizations to audit remote access tools to identify the ones in use and authorized. Open the console, count the computers connected, and list who holds a login. CISA also notes that portable versions run without installing, so a tool can exist without showing in the usual program list.
- The domain name account. Look up your domain at lookup.icann.org. The Registrar field names the company, and the registered name holder is the person who receives the transfer code. Check that this is your company, and a name you can reach.
- Backup, firewall, and vendor portals. Any login where their email address is the account contact.
- Their phone. If they approved sign-ins from a personal phone for an account the company uses, change the sign-in method. Microsoft’s removal steps also cover wiping company data from a phone or tablet they used for work.
Days three to five: the handoff, if you can get one
If the person left on speaking terms, a short written handoff is worth asking for. Three questions cover most of it.
- What renews? Domain names, certificates, licenses, and subscriptions, with the date and the card or account that pays.
- What runs on a schedule? Backup jobs, reports, and anything that only works because a certain account is signed in.
- Who did they call? The internet provider, the phone company, the vendor with the support line, and the account name each one knows.
Days five to seven: look for what you didn’t know existed
Open the user list in the admin center and mark each name: works here, belongs to your provider, or nobody can say. CISA’s guidance for customers of managed service providers warns that disabling accounts which no longer manage infrastructure is easy to overlook, and asks customers to do it.
Ask whoever holds the admin center to read the sign-in record for the departed account since the day it was disabled. Any attempt after that date is worth writing down with the time.
What this list can and can’t show
It shows who is named on each account today. It doesn’t show whether a password was shared, or whether anything was copied before the last day.
We read the roles, records, and tools with you and tell you what we found and what we didn’t, with dates. A person reads the result.
Whoever leaves takes what they remember, and the list is how you keep the rest.
Related
Sources
- Microsoft: Remove a former employee
- Microsoft: Revoke user access in an emergency in Microsoft Entra ID
- CISA: Protecting Against Malicious Use of Remote Monitoring and Management Software (AA23-025A)
- CISA: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)
- ICANN: Name Holder FAQs
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.