IT Onboarding and Offboarding of Employees in SMEs

The worst incident in your IT environment usually isn't a hacker from outside; it's a forgotten account on the inside. A former employee who can still get into Dropbox months after leaving, a laptop that was never returned, a password that was never rotated. In this article we explain how to set up IT onboarding and offboarding in your small or mid-sized business so that it happens lawfully, securely and quickly. We look at the numbers behind the risk, give you concrete checklists for both processes, and show how automation with Microsoft Entra makes it manageable without burying your IT team in tickets.

Joiner, Mover, Leaver: the framework

Identity governance has used the JML framework for years: Joiner, Mover and Leaver. A Joiner is starting with the company and needs access and equipment to get going. A Mover changes role or department and therefore needs different access rights (and, just as importantly, needs to lose the old ones). A Leaver is leaving the company and must lose all their access within an agreed timeframe.

In practice, SMEs spend by far the most time on the Joiner phase and the least on the Mover and Leaver phases. That's understandable (a new starter flags their own needs; a Mover or Leaver doesn't), but that is exactly where the security risk lies. A Mover who keeps their old access and builds up more and more rights with every change is a case of "access creep". A Leaver who keeps their account leaves behind an "orphaned account", and statistically these are a well-known entry point for incidents.

The numbers behind offboarding risk

Sloppy offboarding is not a theoretical problem. A few hard numbers:

• In a Beyond Identity survey, 83 percent of former employees said they still had access to a previous employer's digital assets after leaving.
• 56 percent of those former employees admitted to deliberately using that retained access to harm their former employer.
• 74 percent of the managers and executives surveyed confirmed that their company had been negatively affected by a security incident caused by a former employee.
• According to the Verizon Data Breach Investigations Report 2025, 22 percent of all data breaches started with stolen credentials, and in the EMEA region 29 percent of data breaches came from an internal actor.
• 59 percent of departing employees take confidential data with them (customer lists, pricing, source code, HR records); according to Carnegie Mellon CERT, 70 percent of internal IP theft takes place within 30 days of a resignation being announced.

A few well-known incidents illustrate the point. The Colonial Pipeline attack (2021) came in through an old, inactive VPN account without MFA. An Akira ransomware incident in 2025 hit a manufacturing company through a third-party vendor account that had never been deactivated. The common denominator: an account that should have been removed was still there.

Why SMEs underestimate this risk

In a small business, offboarding feels informal. Everyone knows each other, and the idea of a former colleague breaking in feels far-fetched. But the problem isn't mainly malice; it's that a forgotten account is a way in for someone else. Phishing, brute force, third-party breaches: as soon as a former employee's password turns up somewhere, it's a valid key.

Then there's the SaaS explosion. The average employee uses around 29 different SaaS apps, and the average company has around 106. 41 percent of those apps are used by just one employee, which exposes shadow IT. So when someone leaves, you don't have 5 accounts to deactivate but 30, some of which IT doesn't even know about. Anyone trying to keep track of this manually will inevitably miss something. Our guide on how to protect your business against hackers goes deeper into these layered risks.

The onboarding checklist: the right access on day one

Smooth onboarding isn't a luxury; it's a first impression. Manual onboarding takes an average of 23 hours per new employee: around 10 hours for HR, 5 hours for IT and 8 hours for the manager. For an SME, that means at least a day and a half spread across three roles, while the new colleague spends their first week constantly running into "waiting for IT".

The checklist for a Microsoft 365 or Google Workspace environment:

• An account in Entra ID or Workspace, following the correct naming convention.
• A licence assigned (Microsoft 365 Business Standard, Premium or the Workspace equivalent).
• Hardware ordered or set up: laptop, monitor, headset and a second screen if needed.
• Zero-touch deployment via Windows Autopilot, Apple Business Manager or Google Zero-Touch Enrollment: on first sign-in, the device automatically receives its configuration, apps and policies.
• MFA setup mandatory on day one.
• Conditional Access policies applied.
• Access to the right SharePoint sites, shared mailboxes and applications.
• Membership of the right Entra groups and distribution lists.
• Security awareness training scheduled.
• Email signature configured.
• Tickets, documentation and a password manager invitation ready to go.

SME owners often opt for a combination of Microsoft 365 as the foundation and an external partner that automates this checklist. It takes a fraction of the time it would take to do everything by hand, and it means no new colleague spends their first day waiting for a password to arrive via WhatsApp.

The offboarding checklist: gone means gone

The offboarding checklist is longer than most SMEs expect. Here's what needs to happen when someone leaves:

• Disable the account in Entra ID on the last working day (don't delete it straight away; that way the data and mailbox remain accessible).
• Revoke the licence within 24 to 48 hours of departure.
• Convert the mailbox to a shared mailbox or forward it to the manager. By default, Microsoft retains OneDrive for 30 days after a user is deleted; this can be configured in the SharePoint Admin Center.
• Transfer OneDrive and relevant SharePoint content to the manager or team.
• Unenrol all devices from MDM (Intune: Retire for app data, or Delete for full removal).
• Collect or ship back the hardware. According to Gartner, organisations recover around 50 percent of laptops at best, and the return rate for monitors is practically zero. An agreed return procedure, and possibly a device-as-a-service contract, makes this easier to manage.
• Rotate passwords for shared accounts (forgetting to rotate them is a classic insider entry point).
• Deactivate SaaS accounts. With SCIM provisioning, this happens automatically for all connected apps; without SCIM, IT has to do it manually, app by app.
• Revoke VPN access and any admin roles.
• Get access badges, keys and physical equipment back.
• Update the HR file and apply GDPR retention periods (payroll tax declaration 5 years, tax-relevant data 7 years, most other data 2 years after the employee leaves). For a former employee's mailbox, 6 months is often used as the guideline period.

The order matters. An experienced IT partner always handles offboarding in the same order, using a checklist that is verified by the manager.

Mover: the neglected phase

Between Joiner and Leaver sits the Mover. Someone moves from marketing to sales, or takes on a management role. The main risk here is access creep: new rights are added, old ones stay put. After a few years, an employee has access to almost everything. If that one person is hit by an incident or phishing attack, the blast radius is unnecessarily large.

A simple practice: with every change of role, the manager reviews access rights together with IT. What needs to be added, and what needs to be removed? Also running an annual access review on sensitive groups as standard is a strong complement to the JML process. It fits within the broader principle of least privilege, which also features in our modern workplace guide.

Automation: Microsoft Entra Lifecycle Workflows and SCIM

In 2026, a manual JML process no longer scales. Two building blocks help:

Microsoft Entra Lifecycle Workflows, generally available since 7 June 2023, automates Joiner, Mover and Leaver events based on changes in HR attributes. Built-in tasks include generating temporary credentials, sending welcome emails, updating user attributes and group memberships, and adding or removing licences. Templates for common scenarios mean you can have it set up within a few days.

SCIM (System for Cross-domain Identity Management) is the IETF standard (RFC 7643 and 7644) for automatic user provisioning to SaaS apps. Microsoft Entra ID, Okta and Google Workspace all support it. Apps connected via SCIM automatically get a new account on a Joiner event, and are automatically deprovisioned on a Leaver event. Without SCIM, IT does this manually for each app, and inevitably misses a few.

For SMEs, this means that instead of working through a 30-point checklist for every person, you define the policy once and Joiner and Leaver events largely run themselves. Use the time you win back for the human side: a proper welcome, an orderly exit interview and knowledge transfer.

GDPR and retention periods after an employee leaves

The GDPR doesn't set a fixed retention period, but it does enforce the principle that personal data must not be kept for longer than necessary. In Dutch practice, indicative periods are used: most of the personnel file 2 years after the employee leaves, the payroll tax declaration and copy of ID 5 years, and salary and tax-relevant data 7 years. For former employees' mailboxes, 6 months is often used as a guideline, after which the account and data should be permanently deleted. Keeping everything for 5 years "just in case" breaches the data minimisation principle; deleting everything on day one means losing data that may still lawfully need to be worked on. Our GDPR guide goes deeper into these trade-offs.

Frequently asked questions about IT onboarding and offboarding

How quickly should I disable a former employee's account?

Disable the account on the last working day; revoke licences and SaaS access within 24 to 48 hours. Full deletion can follow after an agreed period (often 30 days after the last working day), once OneDrive and relevant content have been transferred. This prevents immediate data loss while shutting off access at the same time.

What is the difference between disabling and deleting an account in Entra ID during offboarding?

Disabling blocks sign-in immediately, but the user and their data remain; the manager can access OneDrive and the mailbox through standard mechanisms. Deleting removes the user permanently, and after 30 days the OneDrive data is cleaned up as well (unless configured otherwise). Best practice: disable on the day of departure, delete after the agreed aftercare period.

Do we, as an SME, really need Lifecycle Workflows?

From around 20 employees and more than 10 SaaS apps, automation quickly pays for itself. Lifecycle Workflows is part of Microsoft Entra ID Governance (P2 licence), and is a good investment if you want to handle JML in a structured way without the ticket stress. For smaller organisations, a disciplined checklist with an external partner can be enough.

Do we need to keep a former employee's mailbox?

There is no fixed period in the Netherlands, but a guideline of 6 months is common. The aim is to be able to consult business correspondence without breaching privacy. After that period, the mailbox should be deleted unless there is a specific reason to keep it longer (such as an ongoing legal case).

What about laptops that remote employees don't return?

Set out the obligation to return equipment in the employment contract beforehand, send a prepaid return box as soon as the departure is confirmed, and wipe the device remotely via Intune or MDM if it's delayed. For a structural solution, many SMEs work with device-as-a-service.

What is the minimum an SME should automate?

Three things: mandatory MFA via Conditional Access, access based on Entra groups rather than per person, and a fixed offboarding checklist (digital or in Lifecycle Workflows). That alone addresses around 80 percent of the operational and security risks.

Conclusion

Onboarding and offboarding are the two moments when your IT and your business visibly come together. Smooth onboarding says something about how your company works; tidy offboarding says something about how seriously you take security and compliance. Both processes need a fixed structure, supported by automation where possible and clear ownership where necessary. Get it right and you save time on day one, prevent incidents on day X plus one, and build an audit trail that maintains itself.

Want to set up onboarding and offboarding for your business with Microsoft Entra, SCIM integrations and a workable checklist that HR, IT and managers can all follow? Call TRON Group on +31 85 303 5869 or visit our managed IT page. We connect your HR system to Entra, design JML flows that fit your teams and put an offboarding process in place that makes sure a departed employee has really gone, digitally too.