Seven people who'd left this CPA firm could still open its clients' files.
A 22-person CPA firm north of Atlanta adds up to eight seasonal preparers every January and lets most of them go in May. Getting a new hire working took two or three days. Removing someone who'd left depended on somebody remembering to ask. When we checked the firm's Microsoft 365 in October, seven former employees still had working accounts, and three of them could still sign into the client portal. We turned the first day and the last day of a job into one approved request each, with a record behind every change.
What it was costing
Start with the last day, because that's where the risk was. The oldest active account belonged to a preparer who had left 14 months earlier. Her OneDrive was still syncing, with about 2,300 client documents in it. Nobody had done anything wrong on purpose. Departures went out as an email to the IT provider, when somebody thought to send one.
The firm's cyber-insurance renewal asked a plain question that year: are departing employees' accounts disabled within 24 hours? And the honest answer was no, even though the firm's written security plan said they would be.
The first day cost money in a quieter way. Each seasonal preparer spent about two days in January waiting on a license, a laptop and access to the right client folders. Eight hires at two days each is 16 preparer-days lost in the busiest month of the year. At seven billable hours a day and $125 an hour, that's $14,000 of work the firm paid for and didn't get.
Then the licenses. Nine Microsoft 365 Business Premium licenses were assigned to people who no longer worked there or to nobody at all. That's about $2,376 a year for seats nobody used.
"Our insurance renewal asked if we cut off departing staff within 24 hours. Last year I left it blank. This year I attached the log."
Firm administrator
The software already in place
Everything ran on Microsoft 365 Business Premium: Entra ID for accounts, Intune for the laptops, Exchange Online with a shared mailbox for each team, and SharePoint for client folders split by team. Tax work ran in UltraTax CS, and clients exchanged documents through a SmartVault portal. Neither of those sits inside Microsoft 365, which matters for what a person still does by hand.
Business Premium doesn't include Entra's built-in lifecycle workflows, which need an Entra ID Governance license. So rather than sell the firm a license upgrade, we built the joiner and leaver steps on what they already had.
How it works
In plain English: the office administrator fills in one short form when someone starts or leaves. A partner approves it in Teams. Then the right steps run for that role, and every change is written down.
For a new hire, the approved request creates the account in the firm's naming format and assigns Business Premium through a group. It adds the person to their team's groups and client folders, gives them the shared mailboxes their role uses and assigns their laptop in Intune, so it sets itself up when they open the lid. Their manager gets the first-day sign-in details the afternoon before.
For a departure, the steps run at 5 p.m. on the last day, or straight away when the partner marks it urgent. Sign-in is blocked and every open session is revoked. The person's mailbox becomes a shared mailbox their manager can read, their OneDrive is shared to the manager, their license goes back in the pool and their laptop is retired in Intune.
Each step writes a line to a SharePoint list: what changed, when, who asked and which partner approved it.
What we automated
Everything inside Microsoft 365 for both ends of the job: the account, license, groups, folders, shared mailboxes and laptop on the way in, and the block, revoke, handover and license return on the way out. The record writes itself as each step runs.
What still needs a person
A partner approves every start and every departure before anything changes. Nothing is deleted automatically. Mailboxes and OneDrive files are kept for the firm's retention period and removed only when someone decides to. Wiping a laptop needs a second approval.
UltraTax CS and the SmartVault portal are on a checklist that a named person at the firm works through, with each item ticked in the same record. We don't sign into the tax software or the portal. The firm's own administrator does.
Results
Through the first tax season after go-live:
- Former staff with working access: 7 at the October check, 0 since.
- Last day to access removed: anywhere from a day to 14 months before. Now it's the same afternoon, a median of 18 minutes after the partner approves.
- New hire ready to work: two to three days before. All eight January seasonal preparers were signed in and working before 9 a.m. on their first day.
- Licenses recovered: 9, about $2,376 a year.
- The insurance question about cutting off departing staff within 24 hours: answered yes, with the record attached.
The pair was built back to back in 17 business days, at the published bundle price.
Same method, your firm
Engineering and architecture firms have the same two days, with an Autodesk license and project folders in place of the tax software. Your hiring might start in Gusto or BambooHR instead of a form. Or your IT provider might hold admin on the tenant, in which case we build it with them. The steps stay the same, and we check first whether something you already pay for does the job.
We've built onboarding and offboarding automation before this project, and it uses the same approval-and-record plumbing as our access review build.
What it costs
Booked together in one scope round, onboarding and offboarding are $5,600 for the pair instead of $7,000, with the same directory and one owner on your side, delivered back to back in about 15 to 18 business days. One of them on its own is The Workflow Fix: $3,500 fixed, about 10 business days once access and inputs are ready. Software and licenses sit outside the price.
Fails the acceptance test we agree in writing? One free in-scope fix of up to 2 hours, then a retest. If it fails again, you choose 10% of that workflow's fee back as a partial refund or credit, up to $350.
Not sure what your tenant can already do? The $350 walkthrough is up to five hours with written findings, credited in full if you go ahead.
Asked and answered
How do you remove a departing employee's Microsoft 365 access the same day?
Make the departure an approved request instead of a reminder: a partner approves, then sign-in is blocked, sessions are revoked, the mailbox goes to the manager and the license is returned, with each step recorded. Chrysis built this for a 22-person CPA firm, where former staff with working logins went from seven to none. Systems outside Microsoft 365, such as tax software, go on a checklist for a named person.
Does Microsoft 365 Business Premium include automated onboarding and offboarding?
Not the built-in kind. Entra ID lifecycle workflows need Entra ID Governance licensing, so Chrysis builds the same joiner and leaver steps on Business Premium with Power Automate and Microsoft Graph, at $3,500 for one workflow or $5,600 for the pair.
Who built it
Chrysis Networks is an automation firm based in Marietta, Georgia, led by Tyler Fameli. We show this project because staff access is where a missed step turns into an exposure, and it's the same work behind our access review build.
Find the login that outlived the job, before someone else does
Tell us how a new hire gets set up today and who removes access when someone leaves. Within one business day you'll get a written reply: whether it fits, what a fixed price would cover and the first thing we'd check.
No employee data or passwords. Not even a user export.