A Microsoft 365 Onboarding and Offboarding Runbook for Small-Office Help Desks

Most small-office help desks don't fail on hard problems. They fail on the boring, repeatable ones: a new hire who can't sign in on day one, a leaver whose mailbox is still forwarding to a personal Gmail three months later, a shared laptop nobody can unlock. Every one of those tickets is cheap to prevent and expensive to clean up.

This post is the onboarding and offboarding runbook we keep for Microsoft 365 tenants with 10 to 150 people, written as scripts instead of a checklist so the steps actually happen in the same order every time. Everything below uses the Microsoft Graph PowerShell SDK.

1. Connect with the smallest scopes you need

Don't run day-to-day help desk scripts as a Global Administrator. Connect with delegated scopes that match the job, and use a dedicated admin account protected by phishing-resistant MFA.

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All","Directory.Read.All"
Get-MgContext | Select-Object Account, Scopes

If a script only reads data (reports, audits), connect with User.Read.All and nothing else. It's one line of discipline that keeps a typo from becoming an incident.

2. Onboarding: groups do the work, not people

The single biggest improvement for a small help desk is to stop assigning licences, Teams, SharePoint sites and shared mailboxes one by one. Assign them to a handful of role groups once, then onboarding becomes "create user, add to role group".

$params = @{
  AccountEnabled    = $true
  DisplayName       = "Priya Shah"
  MailNickname      = "pshah"
  UserPrincipalName = "[e-mail]"
  UsageLocation     = "CA"
  PasswordProfile   = @{ ForceChangePasswordNextSignIn = $true; Password = (New-Guid).Guid }
}
$user = New-MgUser @params

# Role group carries the licence (group-based licensing) and app access
$group = Get-MgGroup -Filter "displayName eq 'Role - Accounting'"
New-MgGroupMember -GroupId $group.Id -DirectoryObjectId $user.Id

Two details that save tickets later:

• Set UsageLocation before licensing. Licence assignment fails silently in group-based licensing if it's missing, and the new hire shows up on Monday with no mailbox.
• Send the temporary password out of band (a phone call or the manager's hands), never to the personal email the person used to apply.

3. Pre-stage the device, not just the account

An account without a ready laptop is still a day-one ticket. If the devices are enrolled in Intune with Windows Autopilot, assign the device to the user before it ships so the first sign-in pulls policy, apps and OneDrive Known Folder Move on its own. If you're not on Autopilot yet, at least keep a written image checklist: BitLocker on, local admin removed, updates current, the line-of-business apps installed and tested.

4. Offboarding: order matters

Offboarding is where small businesses leak data. The order below closes access first, preserves data second, and cleans up last.

$upn  = "[e-mail]"
$user = Get-MgUser -UserId $upn

# 1. Block sign-in and kill existing sessions
Update-MgUser -UserId $user.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $user.Id

# 2. Record group memberships before removing them (you will be asked later)
Get-MgUserMemberOf -UserId $user.Id -All |
  Select-Object Id, @{n='Name';e={$_.AdditionalProperties.displayName}} |
  Export-Csv ".\$($user.MailNickname)-groups.csv" -NoTypeInformation

# 3. Remove from groups (licences drop with the role group)
Get-MgUserMemberOf -UserId $user.Id -All | ForEach-Object {
  Remove-MgGroupMemberByRef -GroupId $_.Id -DirectoryObjectId $user.Id -ErrorAction SilentlyContinue
}

Then, in Exchange Online PowerShell, convert the mailbox to shared (so it stays searchable without a licence, within the size limit) and check for forwarding rules the person set themselves:

Connect-ExchangeOnline
Set-Mailbox -Identity $upn -Type Shared
Get-InboxRule -Mailbox $upn | Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo }
Set-Mailbox -Identity $upn -ForwardingSmtpAddress $null -DeliverToMailboxAndForward $false

That forwarding check is the step people skip, and it's the one that matters most when someone leaves on bad terms.

5. Make the help desk the system of record

Scripts only help if someone can see what happened. Log every run, who ran it and for which user, to a place the whole team can read:

Start-Transcript -Path "\\fileserver\it-logs\offboard-$($user.MailNickname)-$(Get-Date -Format yyyyMMdd-HHmm).txt"
# ... runbook steps ...
Stop-Transcript

Attach the transcript to the ticket. Six months later, when an auditor or a lawyer asks "when exactly did this person lose access?", the answer is one search away instead of a guess.

6. What to measure

For a small help desk, three numbers tell you most of what you need:

1. Day-one success rate: new hires who could sign in, open email and reach their files on their first morning.
2. Time to revoke: minutes from "HR says they're gone" to sign-in blocked and sessions revoked. Aim for under 15.
3. Repeat tickets: the same issue from the same person within 30 days. A high number means you're closing tickets, not fixing problems.

Wrapping up

None of this needs expensive tooling. It needs the steps written down once, run the same way every time, and logged. That's the approach our IT help desk Toronto engineers use for small and mid-sized offices, and the scripts above are a good starting point for any team running Microsoft 365, wherever you are.

Disclosure: I work at Senator Networks, a managed IT provider. The scripts are generic Microsoft Graph and Exchange Online PowerShell and work in any tenant; test them against a non-production user first.