Offboarding

When an employee leaves your organization or has their account disabled in Microsoft 365, their access to SharePoint sites doesn't automatically disappear. The Offboarding section in Tenaxis helps you find and remove that lingering access - either manually or automatically.

The Problem: Stale Access After Departure

When an employee is offboarded, IT typically:

1. Disables their account in Azure Active Directory (Entra ID)
2. Transfers or deletes their mailbox and files

But one thing that's frequently missed is removing them from SharePoint sites and Teams. Their account may be disabled, but they could still have permissions stored in M365 group memberships - and if the account ever gets re-enabled (even temporarily), that access would still be there.

Tenaxis solves this by regularly checking whether site members' accounts are still enabled, and flagging (or automatically removing) the ones that aren't.

The Offboarding Page

Go to Offboarding in the left sidebar.

This page shows a list of all disabled Entra ID accounts that still have membership in one or more SharePoint sites managed by Tenaxis.

For each disabled user, you can see:

• Their display name and UPN (email)
• Each site they still have access to, along with their role on that site
• Whether they're the only owner of any site (which requires manual intervention before they can be removed)

Manually Removing a Disabled User

To remove a specific disabled user from all their sites:

1. Find the user in the Offboarding list
2. Click Remove from All Sites
3. Confirm the action

Tenaxis will remove the user from every site they're currently a member of. This action is logged in the Audit Log.

What If They're the Only Owner?

If the user is the only owner of a site, Tenaxis will not automatically remove them. This is a safety measure - removing the last owner creates an "orphaned" site with no one responsible for it.

Instead, you'll see a warning: "This user is the sole owner of [Site Name]. Assign another owner first."

To resolve this:

1. Go to the Sites section
2. Open the site they're the sole owner of
3. Add another person as an Owner
4. Return to Offboarding and remove the disabled user

Re-Checking Account Status

The Re-check button lets you immediately verify a user's current account status in Microsoft 365, rather than waiting for the next scheduled sync.

Use this if:

• You've just disabled an account and want to confirm Tenaxis has picked it up
• You've re-enabled an account (e.g., a contractor returning) and want Tenaxis to update
• A user shows as disabled in Tenaxis but you believe their account is actually still active

1. Find the user in the Offboarding list
2. Click Re-check
3. Tenaxis queries Microsoft Graph for the current account status and updates the record

Automatic Offboarding

Instead of manually reviewing the Offboarding page, you can enable automatic removal of disabled accounts.

Enabling Auto-Remove

1. Go to Settings
2. Scroll to the Offboarding section
3. Toggle Auto-Remove Disabled Accounts to ON
4. Click Save

How It Works

Once enabled, Tenaxis runs a nightly scan (at 07:00 UTC) that:

1. Identifies all site members whose account status is "disabled" in Entra ID
2. Automatically removes them from all sites they're a member of
3. Skips users who are the sole owner of any site - those are flagged for manual review instead
4. Logs every removal action in the audit trail

What's Still Manual

Even with auto-remove enabled, you'll still need to manually handle:

• Users who are the sole owner of a site (assign another owner first)
• Users who were manually added back after removal (if a contractor returns, for example)
• Any removals you want to review first before they happen

The Nightly Scan

Tenaxis runs a background check every day that:

1. Pulls the current list of all site members
2. Checks each member's account status via Microsoft Graph
3. Flags any with accountEnabled: false
4. If auto-remove is on: removes them (except sole owners)
5. If auto-remove is off: adds them to the Offboarding page for manual review

The scan results are reflected in:

• The Offboarding page
• The Users page (account status column)
• The site detail Members tab (disabled users are highlighted)
• The Audit Log (each removal is logged)

Best Practices for Offboarding

Immediately after disabling an account:

1. Check the Offboarding page for that user
2. Verify they're not the sole owner of any sites
3. If they are, assign a new owner to those sites
4. Use Remove from All Sites to clean up immediately

Ongoing:

• Enable Auto-Remove (in Settings) so you don't have to remember to check manually
• Set up a Webhook for the site.deleted or risk events so your ITSM tool is notified when offboarding actions happen
• Review the Audit Log monthly to confirm offboarding actions are being logged correctly

Departing Employees

The Departing Employees tab (second tab on the Offboarding page) lets you proactively track employees who are leaving the organization — before their Entra ID account is disabled. This is useful when you know in advance that someone is leaving (resignation, end of contract, redundancy) and want to make sure their site access is reviewed and cleaned up before their last day.

Adding a Departing Employee

Manually:

1. Go to Offboarding → Departing Employees tab
2. Click Add Employee
3. Enter their display name, UPN (email), and departure date
4. Click Save

Via CSV import:

1. Click Import CSV
2. Upload a CSV file with columns: displayName, upn, departureDate
3. Dates can be in ISO format (2026-07-31) or Dutch format (31-07-2026)
4. Tenaxis imports all rows and creates entries in PENDING status

Status Workflow

Pre-Departure Alerts

Five days before the departure date, Tenaxis automatically:

1. Looks up all sites the employee is a member of
2. Sends an email to the relevant site owners listing the employee's current access
3. Updates the status to Review Sent

This gives site owners time to remove the employee from their sites or transfer ownership before the last day.

Post-Departure Escalation

After the departure date, Tenaxis checks whether the employee's Entra ID account is still active. If the account is still enabled after departure, IT admins receive an alert to investigate and manually disable or remove the account.

Marking as Resolved

Once you have confirmed the employee's access has been fully removed:

1. Find the entry in the Departing Employees list
2. Click Mark Resolved

Resolved entries remain visible for audit purposes but are no longer included in active monitoring.

Deleting an Entry

If an employee was added by mistake (e.g. their departure was cancelled):

1. Find the entry in the list
2. Click Delete

This permanently removes the entry with no audit record of it having existed.

Connection to Access Reviews

Access Reviews and Offboarding work together. During an Access Review, site owners might mark a disabled user for removal. This is captured in the review record. The Offboarding auto-remove, separately, removes them nightly.

Both mechanisms complement each other:

• Access Reviews catch people who should no longer have access (regardless of account status)
• Offboarding catches people who can't log in anyway (disabled accounts)

For the highest security posture, use both.