Guides / Guide

M365 JML automation: the checklist that actually stops offboarding leaks

10 September 2026 · M365 & Security

Background

Every org I've worked in had a JML process on paper. Almost none of them had one a leaver's manager couldn't quietly bypass. The gap is never the joiner side - a new starter with no access complains loudly on day one. The leak is always leavers: someone moves department, or leaves entirely, and their access follows them anyway because it was never tied to anything that updates itself.

The load-bearing spreadsheet problem, applied to identity: if "who has access to what" lives in a spreadsheet someone updates manually, it's already wrong. It was wrong the day after it was last reviewed.

Setup

The fix is dynamic, not procedural - access rules that recalculate themselves rather than a person remembering to update a list.

  • Dynamic security groups, membership rule on department/job title/employment status attributes synced from your HR source of truth, not on manual add/remove.
  • Access packages in Entra ID Governance for anything that needs an approval step - a manager or resource owner signs off, but the removal is still automatic when the underlying attribute changes.
  • A leaver trigger from HR, not IT. IT should never be the first system to hear someone's left - by the time IT finds out manually, the access window has already been open for days.
  • Licence reclaim on offboard, not on a quarterly audit. An unused E5 licence sitting on a disabled account for three months is money leaking quietly, and nobody notices because nothing broke.
HR system marks leaver
        │
        ▼
Dynamic group membership recalculates (attribute-driven, not a workflow step)
        │
        ▼
Access packages revoke, licences unassign, mailbox converts to shared
        │
        ▼
Account disabled → (retention window) → account deleted

Edge Cases & BCP

  • The HR feed is late or wrong. If HR data is the trigger, a bad sync means leavers stay active. Build a daily reconciliation report - active accounts with no matching active HR record - and alert on it. Don't trust the automation to never need a manual check.
  • Someone leaves and comes back within the retention window (contractors do this constantly). Deleting immediately means re-onboarding from scratch; keeping forever is a licensing cost and a data-minimisation problem. Pick a retention window deliberately (30/60/90 days) and write down why, because an auditor will ask.
  • Shared mailboxes and delegate access don't disappear when the delegating account does. Audit delegate permissions before disabling an account, not after - a leaver's mailbox converting to shared doesn't revoke the access three other people had to it.
  • What happens if the automation itself fails silently? This is the one that gets skipped. Monitor the automation, not just the outcome - a Power Automate flow that stops triggering with no error looks identical to "nobody left this month" until you check.

← All guides