Scope & evidence

Cross-SaaS lifecycle checklist with Microsoft 365 as a documented example. Use HR-authorised timing and current service-specific retention guidance.

Research-based; no hands-on test claim.

Confirm authority, timing and scope

Obtain the authorised departure or role-change instruction and the effective time. List the person’s SaaS accounts, privileged roles, devices, shared resources and application ownership. Include services outside the central identity provider.

Coordinate with the appropriate data owner on retention, investigation or legal-hold requirements. Do not make an individual technician decide whether business records should be destroyed. Record who approved the scope and any timing constraints.

Transfer business ownership first where appropriate

Identify documents, mailboxes, workflows, code repositories and subscriptions that depend on the departing account. Assign a new owner through supported administration functions. Check automations and integrations that use the person’s token or credentials.

Preserve required data using the service’s supported process. Exporting a folder may not preserve permissions, version history or application relationships. For Microsoft 365, follow the workload-specific sequence and licence requirements rather than assuming all services retain data identically.

Revoke access across all layers

At the approved time, block or disable sign-in and apply the provider’s session and token revocation process. Remove groups, privileged roles, partner access and local or external accounts as applicable. Rotate shared secrets that the person knew where the risk assessment requires it.

Check persistent agents, mobile sessions, API keys and recovery methods. Single sign-on removal may not terminate every active session or separately managed credential immediately. Verify behaviour instead of treating a single directory action as complete offboarding.

Close with evidence and a retention review

Use the checklist below to record the outcome and remaining exceptions. Confirm that replacement owners can perform their work and that the departed identity cannot regain access through an old recovery path.

Remove licences and delete accounts only when the approved retention and transfer requirements have been met. Schedule any later deletion as a tracked task with an owner; do not claim it occurred because it was planned. Keep the completion record appropriately restricted.

StepCompletion evidence
AuthorityApproved scope and effective time
OwnershipNew owners and validated workflows
RetentionService-specific preservation decision
AccessSign-in, sessions, tokens and downstream checks
ClosureLicences, later deletion tasks and exceptions

References

Next useful steps

Read our editorial and corrections policy.