AllTech
On this page
Field notes from the engineering team
New hire and leaver requests are the largest single group of tickets our help desk handles. Most of them are routine. The ones that go wrong go wrong the same way: the request arrives on the start day or the last day, or it leaves out something IT needs.
A late new hire request means a new person sits without a login. A late leaver request is worse, because a former employee can keep access to email, files and apps. This guide covers what to send, when to send it, and what happens on our side.
The short version
| Item | Detail |
|---|---|
| New hire | Send one request a week before the start date. |
| Include | Name, role, start date, device, folders, and remote access. |
| Leaver | Tell IT before the last day. Access is disabled on the last day. |
| Why it matters | Disabling an account is not the same as ending every open session. |
| Who sends it | One named person per office, so requests do not get lost. |
What a new hire request needs
When the request arrives on the start day, someone has to wait. When it arrives without the details, IT has to come back with questions and the wait gets longer. One message a week ahead, with these items, covers most of it:
- Name and role. The role tells IT which groups and licenses the person needs.
- Start date. The date the person needs to be able to sign in.
- Device. A new computer, a replacement, or a spare. A new device takes longer than a login, so say so early.
- Folders and shared mailboxes. Name the folders and who owns them. The folder owner approves access, not IT.
- Remote access. Say whether the person will work from home or from more than one location.
- Phone and extras. Desk phone, mobile access to email, printer, and any line-of-business software.
A role-based checklist works better than a blank request. If two people in the same role need the same access, the second request should take minutes.
What a leaver request needs
A leaver request is shorter, but timing matters more:
- Name and last day. Include the time of day if access should end before the end of the shift.
- Who takes over the mailbox and files. Decide before the last day, not after.
- Equipment. Laptop, phone, badge, keys, and any token or key fob.
- Apps outside Microsoft 365. Any web tool the person logged in to with a separate account.
Microsoft’s guidance on revoking access names employee termination as one of the cases where an administrator needs to cut off access. For a Microsoft Entra ID account, the steps it lists are to clear the Account enabled setting, which blocks new sign-ins, and to select Revoke sessions. Environments that sync with an on-premises Active Directory have additional steps there.
Disabling an account does not end every session
This is the part most people do not expect. By default, access tokens issued by Microsoft Entra ID last for one hour. After an account is disabled, a person who is already signed in can keep access until the token expires.
Apps that use their own session tokens are a different case. Microsoft states that Entra ID cannot directly revoke a session token an application issued. The application has to end the session itself, or it has to receive the disabled state through provisioning and act on it. Microsoft notes that app provisioning typically runs every 20 to 40 minutes.
Two more points from the same page:
- Intune can reset a managed device to factory settings, or wipe corporate data from managed apps on an unmanaged device. Either only works when the device is connected to the internet. If it is offline, locally stored data stays on it. A wipe also cannot be undone.
- Apps that do not support automatic deprovisioning need a manual process. Someone has to know which apps those are and who removes the person from each.
That is why the leaver request should name every app, not just email.
What to do
1. Pick one person per office to send requests. A single sender means IT knows who to ask when a detail is missing.
2. Send new hire requests a week ahead. Use the same form every time, with the six items above.
3. Tell IT about a leaver before the last day. For a planned departure, send the request as soon as the date is set. For an urgent departure, call the help desk rather than send an email.
4. Keep a list of the apps your staff use. Include web tools that have their own logins. It is the list IT works from on a leaver’s last day.
5. Get folder access approved by the folder owner. Use groups, not single users, so that role-based access is easy to repeat and easy to remove.
6. Collect equipment before the last day ends. A laptop that has not come back is a laptop that can still hold data.
7. Review the list twice a year. Compare active accounts against the staff list. Accounts with no matching person should be questioned.
How we help
Our help desk handles new hire and leaver requests. Accounts, groups, licenses and device policies live in Entra ID and Intune, where we set up role-based access and manage the devices that go with it. Mailboxes and shared folders are part of Microsoft 365 and cloud.
Leaver access matters most where records are sensitive. Law firms, healthcare practices and municipalities all have client, patient or resident data that a former employee should not be able to reach. If you want to know how your onboarding and offboarding works today, contact us.
