The Microsoft 365 user onboarding and offboarding runbook (manual, before you automate)

Everybody wants to automate onboarding and offboarding, and they should. But automation only works when the underlying process is clean and consistent, and most small businesses don't have that yet. They have a half-remembered checklist in one person's head. This guide gives you that checklist written down: the exact manual steps to bring a Microsoft 365 user on board and to shut one down securely. It's for the office manager or IT generalist who handles user accounts, and it's deliberately the prerequisite to automating any of it. Get this repeatable by hand first, then a tool can do it for you.

Before you start

• An account with the User Administrator or Global Administrator role.
• Available Microsoft 365 licenses (check Billing > Licenses in the admin center before someone's start date).
• A list of the groups, teams, and shared mailboxes each role should belong to. Build this once per role and reuse it.
• For offboarding: the name of the person who will take over the departing employee's files and email.

Onboarding part 1: create the account

1. Go to the Microsoft 365 admin center at https://admin.microsoft.com.
2. In the left navigation, choose Users > Active users, then click Add a user.
3. Fill in the display name and username (the part before @yourcompany.com). Set the job title, department, and manager, which pay off later for dynamic groups and the org chart.
4. Choose to auto-generate a password and require a change at first sign-in.

Onboarding part 2: assign a license

1. On the Licenses step of the new-user wizard (or later under the user's Licenses and apps tab), check the box for the right plan, for example Microsoft 365 Business Premium.
2. Confirm the location is set correctly, because licensing is location-aware.
3. Save. Assigning the license is what provisions the mailbox and OneDrive, so do this before expecting either to exist.

Onboarding part 3: add to groups

1. Open the new user, go to their Groups tab, and click Add memberships.
2. Add the Microsoft 365 groups and security groups for their role (their department site, relevant Teams, distribution lists).
3. Adding them to the right groups is what grants SharePoint and Teams access, so this is where their day-one access actually comes from.

Onboarding part 4: enforce MFA registration

1. The cleanest approach is a Conditional Access policy that requires multifactor authentication (MFA) for all users, which you set up once in the Microsoft Entra admin center under Protection > Conditional Access.
2. With that in place, the new user is prompted to register an authenticator app at first sign-in automatically.
3. If you use Security Defaults instead of Conditional Access, MFA registration is also enforced on first sign-in. Either way, confirm the user completes registration on day one.

Onboarding part 5: confirm mailbox and OneDrive

1. A few minutes after licensing, the user's Exchange mailbox is ready. Confirm by checking Users > the user > Mail tab.
2. OneDrive provisions on first sign-in, or you can pre-provision it. If the person needs their OneDrive ready before they log in, pre-provisioning avoids a first-day delay.

Offboarding part 1: block sign-in immediately

The moment someone leaves, the priority is cutting access, not tidying up. Do these in order.

1. Open the user under Users > Active users.
2. Click Block sign-in (the slider on the user's panel) and save. This stops new logins right away.

Offboarding part 2: revoke sessions and reset the password

1. Blocking sign-in doesn't kill sessions that are already active. Open the user, go to their account options, and choose Sign out of all sessions (sometimes shown as Revoke sessions).
2. Reset the user's password to a new random value so no saved credential keeps working.

Offboarding part 3: convert the mailbox to shared

1. Converting the mailbox to a shared mailbox lets the team keep the email history without paying for a license.
2. In the Exchange admin center (https://admin.exchange.microsoft.com), open the mailbox, and under mailbox type choose Convert to shared mailbox.
3. Grant the manager or successor access to the shared mailbox so customer emails still get answered.

Offboarding part 4: reassign OneDrive and files

1. In the Microsoft 365 admin center, open the departing user and find the OneDrive tab.
2. Under Get access to files, assign the manager or successor access to the user's OneDrive so their documents aren't lost.
3. Note that OneDrive content is retained for a default period after the account is deleted, but reassign access before you delete anything.

Offboarding part 5: remove from groups and reclaim the license

1. On the user's Groups tab, remove all group memberships so they lose every downstream access path.
2. On the Licenses and apps tab, uncheck the license to free it up for reuse. Do this only after the mailbox is converted to shared, since removing the license too early can disrupt the conversion.
3. Decide when to delete the account. Many businesses keep it blocked but not deleted for 30 to 90 days in case files or email are needed, then delete it.

Verify each runbook worked

• Onboarding: sign in as the new user (or have them confirm) to verify access to email, their department's Teams and SharePoint, and that MFA prompted on first login.
• Offboarding: try to sign in as the departed user (you can't, sign-in is blocked), confirm the mailbox shows as shared, and confirm the successor can open both the shared mailbox and the reassigned OneDrive.

What to do next

Now that you have a written, repeatable runbook, you have the thing automation needs. The same steps can be driven by Power Automate triggered from your HR system, so accounts get created and shut down without anyone remembering to do it. The order matters: get the manual runbook clean first, then automate. If you'd like help turning this checklist into an automated, audited workflow tied to your HR process, that's a project we run often, and we're glad to scope it with you.