When someone leaves, the rush is to free up the licence and move on. That is exactly how doors get left open. A half done offboarding leaves a mailbox still receiving, a phone still logged in, and sessions that stay alive for hours after you think you have shut the account. Here is the order that actually locks a leaver out, and the bits people forget.
Block sign in and kill the live sessions first
The first move is to block sign in on the account, before anything else. But blocking sign in alone does not end sessions that are already open. A token in a phone app can keep working for up to an hour after you disable the account. So after you block sign in, revoke the sign in sessions too, which forces every app and device to ask for a fresh login that will now fail. Do these two together and the person is out in minutes, not next hour. If the account is synced from on premises, disable it in Active Directory and let it sync, or you will see it spring back.
Secure the mailbox and its data before you touch the licence
The mistake is pulling the licence straight away, because that starts a clock on the mailbox and the OneDrive. Deal with the data first. Convert the mailbox to a shared mailbox so it stays reachable without a licence, or put it on litigation hold if you need to keep everything. Set up forwarding to the manager if mail still needs answering, and give the manager or a colleague access to the OneDrive so nothing important is stranded. Only once the data is safe do you move on.
Remove the licence without losing anything
With the mailbox shared and the OneDrive handed over, you can safely remove the licence and reassign it. A shared mailbox under 50GB needs no licence, so you are not paying to keep their mail. Note what you freed up, because unused licences are money, and that is a cleanup worth doing across the whole tenant while you are here.
Retire or wipe their devices
A blocked account on a laptop still sitting in someone's house is a loose end. In Intune, retire the device if it is company owned and being reused, which pulls company data and management off it, or wipe it if it is going back to stock. For a personal phone under BYOD, a retire removes just the company data and leaves their own photos alone. Check the device actually checked in and completed the action, do not assume.
The things people forget
This is where leavers quietly stay connected. Remove them from shared mailboxes and distribution groups they had rights on. Clear any mail forwarding rules they set themselves, not just the one you added. Delete their registered MFA methods and any app passwords, so an old phone cannot be used to get back in. Check whether they were a guest in a partner or client tenant, because that access lives outside yours and survives everything above. And remove them from any admin roles before the account is gone, so you are not left with an orphaned role assignment.
Get the order right and a leaver is fully shut out in minutes, with their data kept and their licence back in the pool. It is the kind of repeatable checklist we build into every client tenant so offboarding is the same every time, not a scramble.