Day 1 after a sole IT admin leaves is an access problem. Every account that can change, delete, or read company data needs a name next to it, and any password the leaver knew has to change, since nobody can say for sure who else has it.
The failure mode
In a 2024 advisory, CISA and MS-ISAC described a state government breach that began with a former employee's administrator account, one that wasn't disabled right after the person left. The attacker likely got the password from a separate data breach, and neither admin account they used had multifactor sign-in turned on. Nobody had to target that agency. A dormant admin login just had to be sitting there.
Disabled is not signed out
Disabling an account isn't the same as ending its sessions. Microsoft's default is that Entra ID access tokens live for 1 hour. Apps that run their own session cookies can keep a person signed in even longer. Its guidance on revoking user access is to disable the account, revoke the sign-in sessions, and in a hybrid setup reset the on-premises password twice. Do all three. Then check the apps that don't use Microsoft sign-in at all.
Gotchas
If nobody knows the admin passwords, start with the systems that can reset the others, which are Microsoft 365, your domain registrar, and the firewall vendor. Each has an ownership-proof recovery process, and none is instant, so file the requests on day 1.
On notice periods, NIST's termination control in SP 800-53 Rev. 5 says to disable access within a period the organization defines, collect credentials, and hold an exit interview. How long that period runs, NIST leaves to you. I'd make it the hour the person stops being the one who's supposed to have the keys. Add a second admin on everything before then.
Turn on multifactor sign-in for every admin account, or confirm it's already on. Check that the last backup finished and that someone besides the leaver can open the backup console.
Takeaway
Disable, revoke, reset, then look at everything outside the directory.
I work at Uprite Services; the longer version of this is on our site.