Offboarding: which SharePoint sites can this person still reach? (and the shares that outlive the account)

The account is disabled, the licence is reclaimed, the laptop is back. The person's access to SharePoint is, at that moment, exactly what it was yesterday: every group membership, every direct grant, every file someone shared with them, every link they made. Disabling stops the sign-in. It does not clean anything.

What actually persists

• SharePoint group memberships (Owners/Members/Visitors, custom groups) on every site they were added to.
• Direct grants on sites, libraries, folders, files.
• Item-level shares where a colleague used Share → their name.
• M365 group memberships, which are Teams-connected site memberships. Offboarding in Entra usually removes these; direct SharePoint grants are not touched.
• Sharing links they created. These belong to the file. An Anyone link a departing salesperson made to a price list keeps working for whoever holds it.
• Site ownership. A site whose only owner has left is a site nobody can administer without an admin intervening.

Per user, tenant-wide

With Advanced Management: SharePoint admin centre → Reports → Data access governance → Site permissions for users → enter the UPN. It lists every site and whether access is full-site or partial, direct or via group. This is the one DAG report that is hard to replace.

Without it, a loop over sites:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
$upn = 'j.doe@contoso.com'
foreach ($s in Get-SPOSite -Limit All) {
  try {
    $u = Get-SPOUser -Site $s.Url -LoginName $upn -ErrorAction Stop
    [pscustomobject]@{ Site=$s.Url; Groups=($u.Groups -join ', '); IsSiteAdmin=$u.IsSiteAdmin }
  } catch { }
}

Get-SPOUser finds the user only if they are known to that site (in a group or directly granted). It does not see item-level shares or links; those need the per-site PnP walk from the full permissions report, filtered to that login.

Per site, properly

On the sites that matter (the ones the report above returns, plus any the manager names), a site collection admin should:

1. Remove the user from every SharePoint group (Remove-PnPGroupMember).
2. Remove direct grants on the web, lists and items (Remove-PnPListItemPermission / role assignment removal in the walk).
3. List sharing links they created (audit log: SharingSet, AnonymousLinkCreated, SecureLinkCreated filtered by UserIds) and decide per link.
4. If they were the only site owner, add another before you leave.

Reverse offboarding: what did they share out

The audit log is the record here. Ninety days of SharingSet / AnonymousLinkCreated / SecureLinkCreated by the departing user tells you which items now have links or grants that should be reviewed, especially external ones.

Connect-ExchangeOnline
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) -UserIds j.doe@contoso.com `
  -Operations SharingSet, AnonymousLinkCreated, SecureLinkCreated, AddedToSecureLink -ResultSize 5000 |
  Select-Object CreationDate, Operations, ObjectId

The checklist to keep

For each leaver: DAG per-user report or the site loop → per-site removal on the hits → audit-log review of links they created → confirm a second owner on any site they owned. Ten minutes for most people; an afternoon for a departing site admin.

On each site, the "what does this person have here, and how" question is what WhoHasAccess365's report answers, with the access chain shown (direct / via group) and guests and broad grants flagged; the Pro sweep adds item-level shares and the links.