A new hire should not spend the first morning waiting for an email account. And when someone leaves, their access should not remain active because an application was forgotten. Both problems start when account changes happen through scattered messages instead of a repeatable process.
Before the first day
Have the manager specify the role, start date, approved applications, and any equipment needed. Prepare the device, enroll it in management, apply updates, and make sure the person can use multifactor authentication. Grant access by role rather than copying every permission from a colleague.
When responsibilities change
Promotions and team moves also deserve an access review. Add what the new role requires and remove access that no longer fits. Otherwise permissions tend to accumulate silently over time.
Before the last day ends
Agree on the departure time and who will notify IT. Disable sign-in and active sessions at the appropriate time, recover devices, transfer business-owned files and mailbox responsibilities, and document any shared accounts or vendor portals. Coordinate with HR and leadership on retention and legal requirements rather than deleting information by habit.
Keep one checklist that names the request owner and records completion. A growing service business will repeat this process many times; the checklist should make the safe path the easy path.
Further reading: Microsoft Entra lifecycle workflows.