Offboard users

Deactivate departed employees: disable sign-in, revoke access, hand over their mailbox

What should happen to each account?