# Employee onboarding and offboarding: close the access gaps Published by Britixo | 2026-10-29 | Security & Microsoft 365 Canonical page: https://britixo.com/business-guides/employee-onboarding-offboarding-access/ Manage access as a joiner, mover and leaver process driven by a trusted employment event and approved role requirements. Specify who authorises access, when it should start or end, and how completion is verified in every connected application. Automation helps only when the underlying identities, role rules and exception handling are correct. Include role changes and non-employee accounts, which are often missed by a simple new-starter and resignation checklist. ## When this guide is useful HR, operations and IT teams coordinating staff access across cloud services and business applications - New starters wait for applications while colleagues share accounts to keep work moving. - Departed staff still appear active in specialist SaaS tools. - A role change adds permissions but never removes the previous department's access. - HR, IT and managers maintain different versions of the same staff list. ## Choose the authoritative event and approval route Identify where a confirmed start, role change or departure is recorded, who can approve it and which time zone applies. Distinguish a draft recruitment record from an instruction to create live access. For urgent departures, establish a verified route that reaches an authorised administrator without depending on an unattended queue. Define role-based access packages in plain language with the relevant application owners. The package should specify what the role needs, while sensitive access may require an additional named approval. Avoid using another employee's entire access list as the default template; it can copy years of accumulated exceptions into a new account. ## Connect identity changes to the applications themselves Microsoft describes lifecycle workflows around joiner, mover and leaver events, while app provisioning maintains identities in connected services. Single sign-on and provisioning solve different parts of the problem. Check whether each application supports account creation, role updates, suspension and session handling through the integration you intend to use. Keep a system-by-system matrix for unsupported or partially supported actions. A service may accept login through the central identity provider yet retain local credentials, API tokens or an independent administrator account. Assign manual tasks where automation cannot safely complete the work, and require confirmation from the application owner. ## Separate access removal from information retention For a leaver, specify the point at which access ends and the sequence for central accounts, devices and connected services. Reconcile any delayed provisioning jobs and verify the resulting state in important applications. A successful workflow notification should be supported by an observable access result. Handle business records, mailbox continuity and file ownership under the organisation's approved retention and privacy rules. Removing access does not automatically require deleting all information, and a manager's request does not automatically justify unrestricted access to a former employee's content. Record the purpose, authority and scope of any delegated access or ownership transfer. ## Design for mistakes, contractors and role changes Test a cancelled start, an incorrect departure date, a returning employee, a contractor extension and a move between departments. Decide how to reverse an erroneous action without reintroducing inappropriate privileges. Use stable identifiers to match people across systems instead of relying only on names that can change or collide. Review accounts that have no current person, sponsor or service owner. Track missed completion times, manual exceptions and application accounts left behind after central suspension. Use those findings to improve the workflow rather than judging success solely by how quickly the initial account is created. ## Prepare for a useful conversation - A trusted source for approved start, move and leave events. - Role-based access definitions and approvals for sensitive permissions. - An application matrix showing automated and manual lifecycle actions. - Retention, ownership-transfer and urgent-departure procedures. - Tests for cancellation, rehire, contractor expiry and failed provisioning. ## How Britixo can help Britixo can help connect staff lifecycle events with Microsoft 365, CRM and supported business applications. An agreed scope can include process mapping, identity matching, role rules, integration development and exception reporting. We can work with HR and application owners to make completion visible and to separate access decisions from records-retention decisions. Contact Britixo with the systems involved, the current approval process and the failures you want to remove. Platform capabilities, required licences, processing responsibilities and any sensitive offboarding procedures are agreed before automation is enabled. [Contact Britixo](https://britixo.com/contact/?enquiry_type=contact_consultation#contact-form) ## Common questions ### Does single sign-on automatically remove application accounts? No. Authentication and account provisioning are separate. Check how the specific application handles suspension, local credentials, sessions and data ownership. ### Should leaver records always be deleted immediately? Access removal and retention are different decisions. Follow the organisation's applicable retention, privacy and legal requirements, with the appropriate authorised owner. ### What should happen when an employee changes role? Review old access as well as granting the new role's needs. Set an explicit transition period if both roles are temporarily required, then verify its expiry. ## Related guides - [Fix SharePoint oversharing without stopping useful collaboration](https://britixo.com/business-guides/sharepoint-permissions-oversharing/) - [How to roll out phishing-resistant MFA without locking out your team](https://britixo.com/business-guides/phishing-resistant-mfa-rollout/) - [Review a SaaS supplier's security with evidence, not a checkbox](https://britixo.com/business-guides/saas-supplier-security-review/) ## Sources and further reading - [Microsoft: Lifecycle workflows](https://learn.microsoft.com/en-us/entra/id-governance/what-are-lifecycle-workflows) - [Microsoft: Automated application provisioning](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/user-provisioning) Prepared with AI assistance and checked against linked primary documentation. [Editorial approach](https://britixo.com/business-guides/#editorial-approach). Product availability and delivery scope are confirmed for your requirements.