Offboarding is both a security and privacy process

When an employee leaves, an organisation has two key responsibilities.

On the one hand, it must be prevented that the former employee still has access to:

• Microsoft 365;
• company data;
• Teams and SharePoint;
• SaaS applications;
• company devices;
• shared accounts and other company environments.

On the other hand, it must also be avoided that colleagues or other persons gain unlimited access to the full mailbox or other personal data of that employee after their departure without a valid reason.

Is a mailbox in an employee’s name personal?

A business mailbox is a company asset and professional communication may be necessary for the operation and continuity of the enterprise.

However, this does not mean that all content of a mailbox automatically becomes freely accessible to the employer or colleagues after the employee’s departure.

A mailbox such as:

is directly linked to an identifiable natural person. The mailbox and the communication contained therein may therefore include personal data subject to GDPR and other rules on privacy and confidentiality.

Why does FLEXAMIT always request instructions from an authorised person?

FLEXAMIT does not independently decide who within a client organisation may access the mailbox or data of a departing employee.

This decision belongs to the client organisation, which is the responsible party for its personnel data and business processes.

Therefore, we ask for an assignment from a competent or authorised representative of the organisation.

This may be, depending on the organisation, for example:

• the managing director;
• an authorised executive manager;
• HR;
• another formally authorised responsible person.

Which conditions are important in this regard?

For access to or processing of data from a personal business account, the organisation must among other things take fundamental GDPR principles into account.

Purpose limitation

There must be a clear and lawful purpose.

For example, the necessary follow-up of professional correspondence or ensuring business continuity.

Proportionality

The processing must be limited to what is necessary for that purpose.

That a successor must be able to find one ongoing client file, for example, does not automatically mean that person should have unlimited access to search the entire historical mailbox.

Transparency

Employees should be informed via the employment regulations, IT policy, privacy policy, or other appropriate internal agreements about how business accounts and professional communication are handled, including upon termination of employment.

Data minimisation

Only data that is truly necessary for the intended purpose should be further processed.

Storage limitation

Data should not be kept indefinitely just because it is technically possible.

How does correct offboarding proceed?

The exact steps differ per organisation and role, but a professional offboarding process covers at least the following elements.

1. The employee’s access is closed off

At the agreed moment, FLEXAMIT can block access to Microsoft 365.

We do not only look at the password.

Depending on the environment, the following can among others be addressed:

• new Microsoft 365 sign-ins;
• existing sessions;
• MFA and authentication methods;
• Microsoft Entra rights;
• Teams and SharePoint;
• shared mailboxes;
• SaaS applications;
• company devices;
• administrator rights.

2. The mailbox is not simply deleted

A mailbox may contain important professional communication.

Think for example of:

• ongoing client files;
• appointments;
• quotes;
• contractual communication;
• supplier contacts;
• information necessary for business continuity.

Therefore, we first discuss with the authorised person what should be done with the mailbox.

Depending on the circumstances, choices may include:

• an automatic reply indicating that the employee is no longer active;
• an alternative contact address for new correspondence;
• a controlled transfer of necessary professional information;
• temporary retention according to applicable policy;
• conversion to another mailbox form when technically and organisationally appropriate.

3. Why automatic forwarding is not our standard solution

It may seem easy to automatically forward all new mail from a departed employee to their successor.

From a privacy perspective, this is not always the best solution.

Future messages may contain information that:

• is not intended for the successor;
• contains personal data;
• is confidential;
• relates to HR, medical or other sensitive topics;
• is still personally addressed to the former employee by the sender.

4. What if a colleague needs access to old emails?

Sometimes there is a genuine business need to retrieve professional correspondence of a departed employee.

Even then, the following does not automatically apply:

The organisation must determine why access is necessary, who needs that access, and how extensive it should be.

5. What about private or personal communication?

That an employee uses a business mailbox does not mean that every message in that mailbox may automatically be freely read by others.

If communication that is clearly personal or private in nature is encountered during necessary processing, it must be handled with particular care.

6. OneDrive deserves equal attention

OneDrive is also linked to an individual user.

It may contain both temporary work files and important company documents.

Before the account is deleted, it must therefore be determined:

• which company data must be retained;
• who needs that data;
• where that data should be stored going forward;
• which personal data should not be unnecessarily further processed.

7. Check Teams, SharePoint and ownership

An employee may be owner of:

• Teams;
• Microsoft 365 groups;
• SharePoint sites;
• shared resources;
• Power Platform or other business processes.

Before the account is deleted, it must be checked whether another authorised employee takes over the necessary ownership.

8. Don’t forget other applications

Microsoft 365 is usually only part of an employee’s digital identity.

Depending on the organisation, other accesses must also be revoked:

• CRM;
• accounting;
• ERP;
• HR platforms;
• VPN or private access;
• password managers;
• social media;
• supplier portals;
• other SaaS applications.

9. Administrator accounts require extra attention

Did the employee have administrative or other elevated rights?

Then extra checks must be made on:

• Microsoft Entra roles;
• Exchange management;
• Intune;
• SharePoint administration;
• local administrator accounts;
• firewalls and network equipment;
• backup platforms;
• external supplier portals;
• shared management credentials.

10. What happens with the company laptop?

The company device must also be handled with care.

When FLEXAMIT manages the device, depending on the configuration, we can among other things:

• remove the company identity;
• wipe company data;
• fully wipe the device;
• reinstall it;
• prepare it again for a next employee.

11. Do not remove the Microsoft 365 licence too early

Removing a licence immediately to save costs may seem logical, but it is not necessarily the first step.

First, it must be determined what should happen with:

• mailbox;
• OneDrive;
• retention;
• archiving;
• Teams and groups;
• other Microsoft 365 services.

12. Retention does not mean indefinite retention

Microsoft 365 offers many technical possibilities to retain information.

But GDPR also applies the principle of storage limitation: personal data may not be kept indefinitely just because storage is cheap or easy.

The organisation must therefore determine:

• which data is still necessary;
• for what purpose it is retained;
• who still needs access to it;
• which legal or contractual retention periods apply;
• when data is no longer necessary.

Why a predefined policy is so important

The worst situation arises when a decision about accounts, mailboxes and data is only made on the employee’s last working day.

A professional organisation establishes in advance:

• how business email may be used;
• how professional and any personal communication are handled;
• what happens to the mailbox upon departure;
• who may request access;
• who may approve that request;
• how long data is retained;
• where structural company data must be stored;
• which technical offboarding steps are performed.

Why FLEXAMIT is deliberately strict with mailbox rights

It would be technically easy to grant mailbox rights immediately upon every request.

That is not how FLEXAMIT operates.

We want a technical action to also be organisationally responsible.

Therefore:

• we verify who gives the assignment;
• we request an assignment from an authorised or mandated person for privacy-sensitive actions;
• we ask the client to confirm that applicable internal and legal conditions have been met;
• we only perform the technically necessary action;
• we avoid unnecessarily broad access when a more limited solution is possible;
• we keep both security and privacy in view.

FLEXAMIT guides the entire process

Good offboarding is at the intersection of:

• Microsoft 365;
• identity & access management;
• cybersecurity;
• endpoint management;
• business continuity;
• privacy and GDPR;
• internal procedures.

Is an employee leaving now?

In summary