An MSP offboarding runbook for Malaysian SMEs—designed to close access quickly without losing the mailbox, files, workflows and customer relationships the business still needs.
Employee offboarding often begins with an HR email and ends with an IT ticket. The dangerous part is everything in between. HR knows the final working time. The manager knows which customer accounts, files and approvals matter. The MSP knows where identities, devices and network access are controlled. If those three views do not meet, a former employee may retain a working session—or the company may discover that a critical automation belonged to an account it has just deleted.
The answer is not simply “change the password.” Microsoft explains that Entra access tokens normally last one hour, while application-issued session cookies may remain valid until the application itself reevaluates access. A central identity provider can stop new tokens, but some SaaS applications still require their own deprovisioning step. Treat departure as an operational event with an owner, an exact effective time and recorded evidence.
Start before the final day, not after it
HR should open one controlled request containing the employee’s legal name, username, last working date and exact cut-off time, manager, risk level, company devices, known applications, and any preservation or legal-hold instruction. The manager should identify the successor for email, files, customer relationships and approval duties. The MSP should map that request to a maintained access inventory.
For routine departures, preparation can begin days ahead while revocation waits for the approved time. For involuntary or high-risk exits, HR and the authorised decision-maker need a private, immediate path to the MSP. As a practical internal objective—not a Microsoft or NIST standard—an SME could require the critical-access phase to be completed and acknowledged within 60 minutes of the approved cut-off.
At cut-off, close identity and active sessions
Disable the account in the authoritative directory, block new sign-ins and revoke refresh tokens or active sessions. Remove privileged roles, group memberships and application assignments. Check registered MFA methods and recovery channels. In a hybrid environment, start with the source directory and confirm that the disabled state has synchronised to the cloud.
Do not assume this is instant everywhere. Microsoft’s June 2026 guidance says the elapsed time depends on how each application grants access; applications with their own session tokens may need explicit revocation. The runbook therefore needs a second list for VPN and firewall accounts, remote-management tools, cloud consoles, line-of-business systems, payment portals, social media, vendor systems and any application that permits direct login. If a shared password was known to the departing employee, rotate it—and make replacing that shared account with named access a follow-up action.
Preserve the work before deleting the person
Access revocation and account deletion are different decisions. Microsoft’s former-employee procedure places mailbox preservation, mobile-device action, email forwarding or shared-mailbox conversion, and OneDrive access before licence removal and account deletion. That sequence matters: deleting first can create avoidable recovery work and interrupt messages from customers or suppliers.
The manager should also transfer ownership of Teams or SharePoint content, Forms, Power Automate flows, shared mailboxes, domains, cloud subscriptions and vendor portals. Customer-facing forwarding must have a named owner and review date; it should not become a permanent, invisible routing rule.
Collect devices, then verify the business still runs
Recover laptops, phones, security keys, access cards and removable media against an asset register. Remote wipe is powerful and irreversible, so use it only with documented authority and after confirming what data must be preserved. Device compliance, local admin rights and cached VPN credentials deserve their own checks.
Finally, test rather than assume. Confirm that sign-in is blocked, privileged access is gone, listed SaaS accounts are closed, equipment is accounted for, and the successor can reach the required mailbox, files and workflows. Record timestamps, the operator, proof of completion and any exception. NIST SP 800-53’s personnel-termination control supports this discipline: organisations should disable access within a defined period, revoke authenticators and notify the relevant roles.
A six-point exit record for the MSP review
- Approved cut-off time and business owner
- Directory, sessions, privileges and MFA handled
- VPN, SaaS, cloud, vendor and shared-secret actions recorded
- Mailbox, files, workflows and external contacts transferred
- Devices and physical credentials recovered or authorised for wipe
- Independent verification, evidence and exceptions signed off
Automation can make this repeatable, especially where HR events feed identity lifecycle workflows. It should not remove approval or hide exceptions. The strongest MSP process gives management two things at the same time: confidence that access has ended, and confidence that the company’s work can continue tomorrow morning.
Sources
- Microsoft Learn: Remove a former employee — Overview, updated 15 June 2026.
- Microsoft Learn: Revoke user access in Microsoft Entra ID, updated 19 June 2026.
- NIST SP 800-53 Rev. 5, Update 1: Security and Privacy Controls for Information Systems and Organizations, official publication page.
- Google Cloud: Revoke access to a Google Cloud project, accessed 14 October 2026.
