Disabled in the HR system. Laptop returned. Still signed in on a phone, still receiving every email to a shared mailbox they had been added to.
Disabling an account does not kill existing sessions, and it does not remove the phone from the mailbox. Revoking sessions does. Removing the device from Intune does. Neither happened because neither was on the list.
The same day leaver process
Disable the account, revoke all sessions, reset the password, remove from every group and shared mailbox, retire or wipe the device in Intune, convert the mailbox to shared with forwarding to the manager, reclaim the licence after thirty days. Written down, in that order, done by whoever is on shift.
It takes twenty minutes. Not having it is how you end up explaining to a client why their emails were read by someone who does not work for you.