Closing the mailbox is where most offboarding stops. Sign-in, sessions, forwarding rules, shared passwords, devices and licences all continue working until somebody deals with each one.
Turning off the mailbox does not turn off access. The account can often still sign in, existing sessions can stay alive on a phone that was never handed back, and anything the person reached with a shared password is untouched, because that password has not changed.
None of this requires anyone to behave badly. The usual outcome is not theft. It is an account nobody watches, still licensed, still able to sign in, sitting there until something else finds it.
The order matters more than the list. Deleting the account first is the most common way businesses lose a mailbox they later need.
Nothing here is negligence. It is the predictable result of offboarding being owned by whoever is free that week.
There is no written record of what a person could reach, so the offboarding covers what is remembered, which is email and the building keys.
Vendor portals, the payroll site and the booking system were each set up by whoever needed them first. They are not in anybody's leaver process because nobody wrote a leaver process.
Removing access feels risky when you do not know what depends on it, so the account stays "just in case" and the case never comes.
This is reversible and takes a minute. Do it before investigating, not after.
Otherwise a device that is already signed in carries on working.
Whether the account has been used since the leaving date, and from where. This is the question you actually want answered.
If mail is being copied out, this is the point at which it becomes urgent rather than untidy.
Starting with anything that touches money or customer data.
Mailbox, files, devices, applications and the licence, in that order.
Where this usually goes next:
Usually not on its own, and deleting is often the wrong first move. Deleting an account can take the mailbox with it, along with anything only that person had in OneDrive, and it does not touch access that lives outside the account: shared passwords they knew, applications they consented to, or a personal device still syncing company files.
The safer order is to block sign-in first, revoke the active sessions, deal with the mailbox and files deliberately, then remove the licence.
Sign-in logs in Entra ID will tell you whether the account has been used and from where. Mailbox rules and forwarding will tell you whether mail is still being copied somewhere. Device records will tell you what is still enrolled and syncing.
All of it is visible to an administrator who knows where to look, which is most of what a review is.
Mostly this is not about the person. An account that nobody uses and nobody watches is an easier target than an account somebody signs into every day, because nothing looks unusual when it is used.
The other reason is administrative rather than dramatic: a licence assigned to somebody who left eleven months ago is a bill you are still paying.
For one recent leaver, an hour or two of an administrator's time. For several years of leavers where nobody is sure who has gone, it is a piece of work rather than a task, because the first job is establishing who those people were.
That is the situation the Security and Cost Review is built for.
A fixed scope review of who has access, how sign-in is protected, where mail goes and what you are paying for.
The five checks to run before removing a licence, and why the order matters.
MFA, access reviews, joiners and leavers, and devices that are managed rather than just handed out.
If the honest answer covers several people over several years, that is the normal starting point rather than an embarrassing one. The review works through it properly.