How to catch all account dependencies during user offboarding
Standard offboarding catches email and licenses, but misses hidden dependencies like Power Apps, custom flows, and SharePoint ownership tied to the departing account. This leaves administrators manually digging through every admin center to prevent broken workflows and orphaned assets.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Manually checking every separate admin centerDid this help you?
- 2Disabling the account immediately and dealing with broken dependencies only when someone complainsDid this help you?
- 3Relying on department managers to figure out what needs to be reassignedDid this help you?
- 4Deleting the user and restoring the account later if issues ariseDid this help you?
- 5Exporting only the required site or data and deleting the rest of the unauthorized informationDid this help you?
- 6Using local controllers or dedicated hardware per client instead of multi-tenant cloud controllersDid this help you?
- 7Tagging every agent and flow with the creator's employee ID from day one to query during offboardingDid this help you?
- 8Pulling reports of ownerless items from an identity provider and inventory toolsDid this help you?
- 9Requiring all new agents to have a team and a backup person assigned as ownersDid this help you?
- 10Pausing unclaimed agents for a few weeks before permanently deleting themDid this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“When someone leaves, the obvious checks are email, OneDrive, groups and licences. But what about Power Apps, flows, connections, SharePoint ownership and other dependencies tied to that account?”source ↗
“Has anyone found a reliable offboarding process that catches everything without checking every admin centre manually?”source ↗
“the agent they wired into the shared drive and a flow running on their token or an api key made for some quick integration usually arent on it”source ↗
“so when the account gets disabled the agent either breaks quietly and someone notices a week later or it keeps going on a service account or key nobody owns anymore.”source ↗
“has anyone got an agents line in their offboarding checklist yet? If so then how”source ↗
“that second scenario is the nightmare fuel, an orphaned service account just chugging along with nobody watching it”source ↗
“I had access to every mailbox in the org. Checked the account and they'd given me, it was a full global admin account for their entire tenant.”source ↗
“We’ve received full backups from a competitor every time we acquire a client from them.”source ↗
Where this came up
People with this problem also raised
- 4Tracking down unmanaged SaaS accounts when an employee leaves
- 6Client tries to reverse cancellation during offboarding
- 7How to quickly revoke all access for a terminated employee
- 4How to track service retirements across multiple client tenants
- 4Why does platform single sign on keep breaking?
- 9Will taking a temporary break ruin my career?