MSP Best Practices: Managing Multiple Client Offboardings

As a managed service provider (MSP), handling employee terminations for multiple clients simultaneously presents unique challenges. Unlike internal IT teams managing a single environment, MSPs must maintain consistency, security, and efficiency across diverse client infrastructures.

The MSP Offboarding Challenge

MSPs typically manage anywhere from 5 to 50+ clients, each with different:

• Active Directory structures and policies
• Microsoft 365 tenant configurations
• Exchange environments (Online, On-Prem, Hybrid)
• Security requirements and compliance standards
• Documentation and ticketing processes

Manual offboarding becomes exponentially complex as you scale. A single missed step in one environment can lead to security incidents, compliance violations, or costly license waste.

1. Standardize Your Offboarding Process

Create a Master Checklist

Develop a comprehensive checklist that applies to all clients:

• ✓ Disable Active Directory account
• ✓ Reset password
• ✓ Remove from all security groups
• ✓ Move to Disabled OU
• ✓ Convert mailbox to shared
• ✓ Set auto-reply message
• ✓ Hide from Global Address List
• ✓ Remove Azure AD devices
• ✓ Wipe Intune-managed devices
• ✓ Revoke Microsoft 365 sessions
• ✓ Reset MFA registration
• ✓ Remove from distribution lists
• ✓ Document all actions in ticket

Customize Per Client

Layer client-specific requirements on top of the master checklist:

• Healthcare clients: HIPAA-specific data retention policies
• Financial services: SOX compliance documentation requirements
• Legal firms: Extended mailbox retention (3-7 years)
• Manufacturing: VPN certificate revocation, facility access

2. Implement Multi-Tenant Management

Centralized vs Distributed Access

Challenge: Managing credentials for 20+ Microsoft 365 tenants

Solutions:

• Delegated Admin Privileges (DAP): Partner Center access to client tenants
• Privileged Identity Management (PIM): Just-in-time admin access
• Service Accounts: Dedicated accounts per client with MFA
• Password Managers: LastPass, 1Password with shared vaults

Context Switching Challenges

When offboarding employees across multiple clients in one day:

• Risk of executing commands in wrong tenant
• Confusion between similar user names
• Mixing up client-specific policies

Best Practice: Use automation tools that maintain tenant context and prevent cross-tenant mistakes.

3. Time Management for MSPs

Calculate Your True Offboarding Time

Average manual offboarding per client:

• Connect to client tenant: 3-5 minutes
• Locate user account: 2-3 minutes
• Execute AD changes: 10-15 minutes
• Exchange configuration: 10-12 minutes
• Azure AD/Intune: 8-10 minutes
• Documentation: 5-8 minutes
• Total: 38-53 minutes per offboarding

For an MSP processing 15-20 terminations per month across all clients:

Manual approach: 10-17.5 hours/month

ROI of Automation

With automated offboarding:

• Per-user time reduced to: 8-12 minutes
• Monthly time for 20 offboardings: 2.6-4 hours
• Time saved: 7-14 hours/month
• Annual savings: 84-168 hours ($4,200-$8,400 at $50/hr)

4. Client Communication Best Practices

Set Expectations Early

In your service agreement, define:

• Response time: "Employee terminations processed within 2 hours of notification"
• Business hours: "Critical terminations handled 24/7, standard requests during business hours"
• Required information: "Client must provide: Full name, username, termination date, manager for mailbox access"
• Pricing: "Included in managed services or $150 per offboarding"

Create a Termination Request Form

Build a form (Google Forms, Microsoft Forms, or ticketing system) that captures:

• Employee full name
• Username/email address
• Termination date and time
• Last day worked
• Manager for mailbox delegation
• Equipment to be collected (laptops, phones)
• Special requirements (legal hold, extended retention)

Post-Termination Reporting

Send clients a completion report including:

• ✓ All actions taken with timestamps
• ✓ Before/after screenshots (optional)
• ✓ Audit log excerpt
• ✓ Mailbox delegation confirmation
• ✓ License reclamation notice
• ✓ 30-day follow-up reminder (mailbox conversion, account deletion)

5. Security Considerations for MSPs

Privileged Access Management

Your MSP has elevated access to all client environments:

• Separation of Duties: Different techs for terminations vs other tasks
• Audit Trails: Log who performed each offboarding and when
• Review Process: Senior tech reviews terminations weekly
• Client Notifications: Automated emails to client admins for each action

Prevent Cross-Client Contamination

Risks:

• Accidentally disabling wrong user in different tenant
• Mixing up mailbox delegations between clients
• Copying data to wrong client's environment

Mitigation:

• Color-code client environments in dashboards
• Require explicit tenant selection before actions
• Implement approval workflows for critical changes
• Use automation that locks to single client context

6. License Management Across Clients

Track License Reclamation

When you offboard an employee, you're potentially freeing up licenses:

• Microsoft 365 E3: $36/user/month → $432/year savings
• Microsoft 365 E5: $57/user/month → $684/year savings
• Intune: $6-8/user/month → $72-96/year savings

MSP Best Practice: Track license reclamation across all clients and report monthly savings. This demonstrates value and justifies your fees.

Shared Mailbox Conversion Timing

Remember: Shared mailboxes under 50GB are free in Microsoft 365

• Immediate conversion: Risky if client needs to access emails right away
• 30-day delay: Allows transition period, then convert
• Set reminders: Calendar or ticketing system alerts for conversion date

7. Documentation and Knowledge Management

Client-Specific Runbooks

For each client, document:

• Unique OU structure for disabled accounts
• Custom auto-reply message templates
• Mailbox delegation policies (manager, team, HR)
• Data retention requirements
• Compliance-specific steps
• Contact information for escalations

Knowledge Base Articles

Create internal KB articles for:

• "Standard Offboarding Procedure v2.0"
• "Multi-Forest AD Offboarding"
• "Exchange Hybrid Mailbox Handling"
• "Emergency After-Hours Termination"
• "Legal Hold Procedures"

8. Scaling Your Offboarding Services

Pricing Models

Option 1: Included in Managed Services

• Terminations are part of monthly fee
• Good for: Predictable client churn
• Risk: Unexpected mass layoffs can overwhelm team

Option 2: Per-Termination Fee

• Charge $100-200 per offboarding
• Good for: Clients with infrequent terminations
• Clear ROI demonstration

Option 3: Hybrid Model

• First 2 terminations/month included
• $125 each additional
• Protects against mass layoff scenarios

When to Bring in Automation

Consider automation tools when:

• You're managing 10+ clients
• Processing 15+ terminations per month
• Spending 10+ hours/month on offboarding
• Missing steps due to manual processes
• Clients complaining about slow turnaround

9. Common MSP Offboarding Mistakes

Mistake 1: Not Documenting Client-Specific Requirements

Impact: Compliance violations, angry clients, re-work

Solution: Client intake questionnaire + annual review

Mistake 2: Delayed License Reclamation

Impact: Clients paying for unused licenses for months

Solution: Automated 30-day follow-up calendar

Mistake 3: Insufficient Audit Logging

Impact: Can't prove compliance during audits

Solution: Screenshot evidence + timestamped logs in tickets

Mistake 4: Wrong Tenant Context

Impact: Disabling wrong user in wrong client = disaster

Solution: Always verify tenant before executing commands

Mistake 5: Ignoring Device Management

Impact: Former employees retain access via mobile devices

Solution: Include Intune device wipe in every offboarding

10. Tools for MSP Offboarding Success

Essential MSP Stack

• PSA (Professional Services Automation): ConnectWise, Autotask, Kaseya BMS
• RMM (Remote Monitoring): Datto, N-able, Ninja
• Documentation: IT Glue, Hudu, Confluence
• Password Management: LastPass, 1Password Teams
• Offboarding Automation: ADATT for multi-tenant Microsoft environments

Integration Opportunities

Connect offboarding tools with:

• PSA ticketing: Auto-create offboarding tickets from client requests
• RMM: Trigger device lockdown/wipe from termination workflow
• Documentation: Auto-update runbooks with completion status
• Billing: Track per-termination fees for invoicing

Conclusion: MSP Offboarding Maturity Model

Level 1: Manual & Reactive

• No standardized process
• Each tech does it differently
• Frequent missed steps
• High error rate

Level 2: Documented Process

• Written checklist exists
• Techs follow (most of the time)
• Still manual execution
• Inconsistent documentation

Level 3: Partially Automated

• PowerShell scripts for common tasks
• Some standardization across clients
• Better audit trails
• Faster turnaround times

Level 4: Fully Automated (MSP Best Practice)

• Single-click offboarding across all clients
• Multi-tenant support built-in
• Comprehensive audit logs
• Client reporting automated
• License tracking integrated
• Zero missed steps