Construction Employee Offboarding: Microsoft 365 and Procore

A construction employee offboarding checklist has to reach far beyond the Microsoft 365 disable button. When a superintendent leaves, the company may still have project email, active Procore assignments, jobsite camera access, a tablet in the trailer, door credentials, saved browser sessions, and files that only one person knows how to find.

The risk is not always a hostile former employee. Often it is a rushed handoff. The next superintendent discovers two weeks later that an RFI is still assigned to the person who left, a client keeps emailing the old mailbox, and nobody recovered the local files from the laptop.

Set one access cutoff across cloud and jobsite systems

Blocking sign-in should happen promptly when employment ends. Preserving business records should happen deliberately before accounts and licenses are deleted. Those are related actions, not the same action.

For an involuntary or high-risk departure, HR or management should set the exact cutoff time. At that time, IT revokes active sessions and cloud access while the responsible operations or security staff remove door, gate, camera, and jobsite-network access. Preserve mailbox, OneDrive, device, and project records without leaving the departing employee able to reach them. If misconduct, litigation, or a claim is possible, coordinate preservation with counsel before wiping or reissuing a device.

Microsoft's former-employee workflow includes blocking access, saving mailbox contents, removing business data from mobile devices, forwarding or converting email, giving another employee access to OneDrive and Outlook data, removing the license, and then deleting the account when the preservation decision is complete.

Microsoft notes that deleted-user OneDrive and Outlook content is retained for 30 days by default. That is a recovery window, not a universal records policy. Contract requirements, legal holds, insurance, and company retention rules may require something different, so confirm those obligations before deletion.

Microsoft 365 is only the first control plane

For a typical construction role, offboarding touches several systems at once:

• Microsoft 365 sign-in sessions, email, Teams, SharePoint, and OneDrive
• Procore company and project directories
• Estimating, accounting, payroll, and vendor portals
• Jobsite Wi-Fi, virtual private network, cameras, and door access
• Company laptops, phones, tablets, hotspots, and storage media
• Password-manager records, passkeys, recovery codes, and browser profiles

The clean sequence is to identify those systems before the last day. A checklist created after the employee leaves will always miss the tool nobody remembered they used.

When	Action	Responsible owner	Evidence of completion
Before the cutoff	Inventory systems, preserve required records, name replacement owners, and reassign active work	Manager, HR, project leadership, and IT	Approved access list, preservation decision, and assignment report
At the approved cutoff	Revoke sessions and cloud access; remove door, camera, VPN, and jobsite-network access	IT and physical-security owner	Timestamped console records and access review
Within 24 hours	Transfer mailbox, OneDrive, vault records, devices, and open Procore responsibilities	Replacement manager and IT	New owner tests access and accepts the transfer
After retention approval	Remove licenses, delete accounts where authorized, and rotate shared credentials the person knew	IT with HR or legal approval	Closed ticket with exceptions documented
Final validation	Compare the completed list with current project, identity, and physical-access rosters	Manager or designated approver	Signed exception list or completion record

Procore has assignments, not just a login

Procore's deactivation guidance says an inactive user can no longer access the company account, but the person's historical activity stays in Procore and open items remain in their current state. Procore recommends closing or reassigning open work before deactivation.

That can include requests for information, submittals, approvals, punch items, observations, and other project responsibilities. Removing someone from one project is different from deactivating the person at the company level. A superintendent moving to another internal role may need project access changed without losing company access.

Disabling the login does not reassign the work. The project can stay stuck on a person who no longer works there.

Recover the device before wiping the business context

Collect and inventory a company-owned laptop first. If misconduct, a claim, or a legal hold is possible, quarantine it and preserve it under the company's approved evidence process instead of performing a routine backup or reset. Otherwise, transfer required project files, downloaded drawings, browser bookmarks, certificate files, and application data before the device is wiped or reissued.

Device-management actions also need care. Microsoft's current Intune guidance explains that Delete, Retire, and Wipe behave differently by platform and enrollment type. Retire usually removes managed business data while preserving personal data. Wipe is appropriate for many corporate-owned devices. Before retiring or deleting the Intune record for an Entra-joined Windows device, back up the BitLocker recovery key and confirm local-administrator access.

A personally owned phone is a different case from a company tablet. Remove the company profile and work data that policy controls. Do not treat someone's personal device like company property.

Transfer the relationship, not only the files

A superintendent's value often lives in context: which subcontractor promised what, why a change was made, which client prefers a phone call, and where the unresolved issue sits. The existing institutional-knowledge article covers that broader risk.

For offboarding, name the replacement owner for each active project and system. Convert or forward the mailbox only after deciding who should receive new messages. Transfer shared vault records. Reassign open Procore items. Change shared credentials that the departing employee knew. Remove door, camera, and jobsite network access on the same timetable as cloud access.

Make the construction employee offboarding checklist role-specific

An estimator and a superintendent do not leave the same access behind. The estimator may control bid portals, takeoff software, and supplier pricing. The superintendent may control cameras, access, field devices, Procore items, and subcontractor invitations. Accounts payable may control banking workflows and invoice mailboxes.

Build a base offboarding process, then add a short role appendix for the positions your company actually has. That turns offboarding from a memory test into a repeatable part of managed IT.

A clean exit protects the person who replaces them

The goal is not to punish the employee who left. It is to make sure the next person can work, the historical record remains trustworthy, and no stale access is waiting for an attacker or an old device to use later.

For a contractor in Fountain, Colorado Springs, or Pueblo, that means cloud identities, field systems, and physical access get handled in one coordinated closeout. Our construction technology work treats those systems as one environment because the job does not care which vendor console held the forgotten account.