iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Revoke a former partner’s access as one coordinated identity-offboarding event, not as a single deletion. First record the person, accounts, privileges, termination time, approver, and retention requirements. Preserve mail, files, ownership, and legal holds through administrator controls; then block sign-in, invalidate sessions and tokens, remove memberships and device access, and only afterward remove licenses or delete accounts.
Google Workspace, Microsoft 365 with Microsoft Entra ID, and Slack are separate control planes. Complete the runbook in each service, then inspect connected applications and unmanaged devices. If compromise is suspected, block sign-in and revoke active sessions immediately, before doing any handoff work.
Start with a coordinated offboarding record
A partner, contractor, or external collaborator can have more than one identity: a primary account, guest records, shared-mailbox permissions, group memberships, OAuth grants, Slack workspaces, mobile devices, security keys, and administrator roles. Treat the event as complete only when each identity and access path has an owner and a recorded outcome.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsInventory every identity and privilege
- Record the person’s legal or directory name, primary email addresses, aliases, personal addresses used for recovery, and any guest or external identities.
- List Google Workspace, Microsoft 365 and Entra ID, Slack workspaces or organizations, connected applications, shared mailboxes, shared drives, sites, groups, channels, and service accounts the person could reach.
- Mark privileged roles, including Google administrators, Microsoft directory or security roles, Slack owners, and any application-specific administrator role.
- Identify company phones, laptops, tablets, security keys, application-specific passwords, and unmanaged devices associated with the account.
Freeze the decision and retention requirements
Create an event record containing the termination or access-removal time, approving manager, administrator performing each action, business owners for data handoff, and any legal hold or investigation reference. Decide which mailbox, OneDrive files, Google files, Slack records, and ownership relationships must remain available. Microsoft identifies Purview eDiscovery as the place to address legal holds; equivalent retention obligations should be handled in the applicable service before deletion.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
For a routine departure, preserve and transfer required data through administrator tools, then block the account before the former user can use the handoff window. For an urgent termination or suspected compromise, block sign-in and revoke sessions first, then perform preservation and transfer with administrative access.
Recommended execution order
- Freeze the event record. Capture the person, all accounts, role, termination time, approver, business owners, and retention or legal-hold requirements.
- Preserve data and ownership. Save mailbox contents, transfer files and document ownership, and arrange continued access for the designated employee without relying on the former user’s credentials.
- Block authentication. Change passwords and disable or block sign-in in Google Workspace and Microsoft Entra ID.
- Invalidate active credentials. Revoke Google OAuth tokens and sign-in cookies, Microsoft refresh tokens, application sessions, security keys, and application-specific passwords as applicable.
- Remove authorization. Delete Google Group memberships, shared-drive permissions, Microsoft groups and site permissions, Slack channel membership, guest access, and privileged roles.
- Contain devices. Wipe or block managed phones and computers, and recover company hardware and security keys.
- Deactivate Slack at the correct scope. Use workspace deactivation for one workspace or organization-level deactivation when an Enterprise Grid user must lose the entire organization relationship.
- Remove licenses and delete only when ready. Record the retention, mailbox, OneDrive, ownership, and audit decisions before removing a license or deleting an account.
- Verify and document. Review audit logs and connected-application inventories, test that sign-in is blocked, and store evidence for every completed action.
Google Workspace runbook
Google Workspace Help summarizes the administrator obligation this way: “As your organization’s administrator, keep your organization’s data safe and secure when a user leaves by completing the following best practices.” The guidance was last updated October 1, 2026. Follow every item; changing only the password leaves recovery, token, device, or cookie paths open.
1. Wipe or contain mobile devices
Use the Admin console’s mobile-device controls to remotely wipe the entire device or only organization data, according to your policy and the device’s ownership. A full wipe is appropriate for company-owned hardware when recovery is not expected; an organization-data wipe limits personal-data impact on a personally owned device. Record the command, administrator, device identifier, and result.
2. Remove recovery methods
Delete the user’s recovery email address and phone number. These methods can otherwise support password recovery after the account has been handed off or the primary password has changed. Check aliases and alternate contact records as well as the visible primary profile.
3. Change the password and reset sign-in cookies
Set a new administrator-controlled password, then reset sign-in cookies. The password change prevents ordinary password reuse; cookie reset removes existing browser and device sign-in state. Do not treat one action as a substitute for the other.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
4. Revoke OAuth access and review authorized applications
Revoke all OAuth 2.0 application tokens and inspect the list of authorized applications. Remove grants that are no longer required, especially for mail, storage, document synchronization, and administrative utilities. An OAuth grant can continue to authorize an application even after a user’s interactive password has changed.
5. Revoke security keys and application-specific passwords
Remove registered security keys and application-specific passwords. Recover physical keys issued by the organization and note any key that cannot be recovered. Application-specific passwords are separate credentials and must be invalidated explicitly.
Free tools Windows power users keep installed
One-click scans. No signup required.
6. Preserve data, memberships, and ownership before deletion
Move or transfer files, shared-drive responsibilities, calendars, mail, and other records that the business must retain. Remove the user from Google Groups and shared resources when the handoff is complete. Keep the original account available until the retention and ownership checklist is signed off.
7. Delete only after the retention decision
Delete the original account when preservation, legal-hold, ownership, and audit requirements are complete. Account deletion is a final lifecycle step, not the first response to a departure.
Automating Google actions with the Admin SDK
The Google Admin SDK Directory API exposes automation surfaces for users.signOut, deleting user OAuth tokens, deleting group memberships, mobile-device actions, and deleting users. Use least-privilege administrator credentials, execute actions in a controlled order, and log the target user, action, timestamp, response, and operator. Automation should fail closed: if a token revocation or device action returns an error, stop the deletion stage and route the exception for review.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Microsoft 365 and Microsoft Entra ID runbook
Microsoft’s former-employee guidance separates access blocking from data handling. It states: “If an employee leaves your organization, you might be wondering what you should do to secure data and prevent unauthorized access.” Microsoft Learn lists the page as updated June 15, 2026.
1. Block sign-in and revoke refresh tokens
In Microsoft Entra ID, block the user from signing in and revoke refresh tokens. Microsoft says Entra access tokens normally last one hour, so an already issued token can remain usable until it expires or the application checks the changed policy. Treat the hour as a product behavior detail, not a guaranteed universal cutoff: applications can cache credentials or enforce their own rules.
Microsoft also cautions that an application’s own session token is controlled by that application. Its guidance is explicit: “To revoke a session token, the application must revoke access based on its own authorization policies.” Sign the user out or deprovision the user in every important application that issues its own cookie or session token; an Entra action alone cannot directly revoke every application session.
2. Save mailbox content and choose the mailbox outcome
Preserve required Outlook mailbox content before removing the license or deleting the account. Depending on the business need, forward incoming mail for a controlled period or convert the mailbox to a shared mailbox. Document who receives access and whether forwarding is approved by policy and privacy requirements.
3. Wipe and block mobile devices
Use the organization’s mobile-management controls to wipe company data or the entire device and block further access. Record whether the device is company-owned or personally owned, the selected wipe scope, and the completion result. Recover company hardware and any associated authentication material.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
4. Transfer OneDrive and Outlook access
Give the designated employee or team access to the former user’s OneDrive and Outlook data through administrator controls. Confirm that ownership and sharing permissions point to current staff, not the departing identity. Keep an evidence record of transferred locations and the receiving owner.
5. Remove groups, sites, and privileged roles
Remove the account from Microsoft 365 groups, SharePoint sites, Teams-related resources, and other shared locations. Review directory, security, compliance, and application roles separately; removing a standard group membership does not necessarily remove a privileged assignment.
6. Remove the license and delete at the proper time
Remove the Microsoft 365 license only after mailbox, OneDrive, ownership, and retention decisions are recorded. Microsoft’s described workflow says deleted-account OneDrive and Outlook content is retained for 30 days. That is a documented product-workflow detail that may change; confirm the current policy for your tenant and keep legal holds separate from this temporary retention window. Delete the user account when the business and legal review authorize it.
7. Account for hybrid synchronization
In a hybrid environment, disable the on-premises Active Directory account and account for synchronization before deleting the cloud object. Otherwise, synchronization can recreate or re-enable an identity. Use the least-privileged role that can perform each step; Microsoft identifies User Administrator or Privileged Authentication Administrator requirements for relevant actions.
Slack runbook
Deactivate the member
A Slack owner or administrator can deactivate a member from the workspace administration controls. Slack states: “They’ll be removed from all channels, signed out of your workspace(s) on all devices, and unable to sign back in.” Deactivation removes the person from channels and signs out devices, but it does not delete their messages or files. Preserve or review those records under your organization’s retention and legal procedures.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Choose workspace or organization scope
On Enterprise Grid, removing someone from one workspace leaves the person in the broader organization. If the former partner must lose the entire organization relationship, use organization-level deactivation rather than removing the account from a single workspace. Check every workspace, guest relationship, shared channel, and organization-level role in the event record.
Transfer ownership before deactivation
A Workspace Primary Owner or Org Primary Owner cannot simply be deactivated until ownership is transferred. Assign a current, approved owner first, verify that billing and administrative responsibilities work under the new owner, and then deactivate the former partner at the required scope.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the three control planes differ
Use this comparison while assigning administrators and checking completion. The propagation descriptions are product behaviors documented by the vendors; where a source does not promise a timing value, it is shown as not stated.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →| Control | Google Workspace | Microsoft 365 and Entra ID | Slack |
|---|---|---|---|
| Immediate sign-in blocking | Change password and reset sign-in cookies | Block sign-in in Entra ID | Deactivate the member |
| Sessions and tokens | Revoke OAuth tokens and reset cookies; revoke security keys and app passwords | Revoke refresh tokens; access tokens normally last one hour | Deactivation signs the member out of workspace devices |
| Connected applications | Review authorized applications and revoke OAuth grants | Deprovision applications that issue their own sessions; Entra cannot directly revoke every app cookie | Check external applications and organization relationships separately |
| Groups and shared resources | Delete Group memberships and shared-drive access | Remove groups, sites, OneDrive and Outlook permissions | Removal from all channels occurs on deactivation; Enterprise Grid requires the correct scope |
| Device response | Wipe the whole device or organization data | Wipe or block managed mobile devices | Workspace deactivation signs out devices; physical recovery remains an administrative task |
| Data handoff | Move retained data before account deletion | Save mailbox content, forward or convert the mailbox, and transfer OneDrive and Outlook access | Messages and files remain after deactivation |
| Timing caveat | Propagation timing not stated in the cited administrator guidance | Access-token lifetime normally one hour; application sessions vary | Deactivation sign-out behavior is stated; organization-level scope matters |
| Audit evidence | Admin actions, API responses, token and device results | Entra sign-in and audit records, mailbox and OneDrive handoff records | Deactivation record, ownership transfer, workspace or organization scope |
Revoke access in connected applications and on unmanaged devices
Identity-provider controls do not automatically cover every service. Build a list of applications that received Google OAuth grants, Microsoft tokens, or separate application credentials. For each one, remove the user, revoke its grant, terminate its sessions, or rotate shared secrets according to that application’s administrator controls. An application that issued its own cookie may continue to recognize the user until its own policy rechecks identity or an administrator ends the session.
Check devices outside mobile-management inventory. Recover company laptops, phones, security keys, and removable media; change shared local passwords; and remove browser profiles or saved credentials where company policy permits. If a device cannot be recovered, treat it as an incident and rely on token, session, and device-management revocation rather than assuming account deletion is sufficient.
Verification: prove that access is gone
Test authentication and authorization separately
- Attempt a controlled sign-in test with an administrator-approved test path and confirm that the former identity cannot authenticate.
- Review active sessions, refresh-token status, OAuth grants, authorized applications, security keys, and application-specific passwords.
- Check group, site, shared-drive, mailbox, OneDrive, channel, guest, and administrator-role membership from an administrator view.
- Confirm mobile-device wipe or block results and record devices that were offline or unreachable.
- Ask each connected-application owner to confirm deprovisioning or session termination; do not infer completion from the identity-provider record.
Store completion evidence
For every action, retain the target identifier, control plane, operator, timestamp in a consistent time zone, action performed, result or error, and approving record. Keep screenshots or exported audit entries where policy permits. Record exceptions explicitly, including an unreachable device, a pending legal hold, a mailbox that remains shared, or an application whose session cannot yet be revoked.
Common failure points and recovery actions
| Symptom | Likely cause | Recovery |
|---|---|---|
| The former partner can still open a connected application | An application-issued cookie or refresh credential survived the directory action | Use that application’s sign-out or deprovisioning control, revoke its grant, and review its audit log. |
| Mail or files disappear during handoff | The account or license was removed before preservation and ownership transfer | Stop deletion, use the service’s retention or recovery process, and document the legal or business owner. |
| A Microsoft identity returns after deletion | Hybrid synchronization recreated or changed the cloud object | Disable the on-premises Active Directory account, check synchronization, then repeat cloud cleanup. |
| The person remains in another Slack workspace | Only one Enterprise Grid workspace was handled | Use organization-level deactivation when the entire organization relationship must end. |
| Google password recovery still works | A recovery phone or email was left in place | Remove recovery methods, change the password, reset sign-in cookies, and verify recovery settings. |
| A Slack owner cannot be deactivated | Primary ownership has not been transferred | Transfer Workspace Primary Owner or Org Primary Owner responsibility to an approved current owner, then deactivate. |
When to escalate immediately
Use the urgent path when the departure is hostile, credentials may be compromised, a privileged role is involved, or an unmanaged device is missing. Block Google and Entra sign-in, revoke Google OAuth and Microsoft refresh tokens, deactivate Slack at the required scope, and terminate sessions in critical applications before notifying the former partner or beginning a handoff. In parallel, preserve logs and legal-hold data through administrator controls. Ask security or legal owners to decide whether the event is an incident, whether a forensic hold is needed, and whether additional credential rotation is required.
Recommended Free Tools
For a planned departure with no suspicion of misuse, the same controls still apply, but data owners can coordinate preservation and transfers first. Do not delay authentication blocking beyond the approved handoff window, and do not remove licenses or delete accounts until retention and ownership evidence is complete.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
