+372 53 888 229info@itabiks.ee

Employee leaving: Microsoft 365 offboarding step by step

A step-by-step guide to closing a leaving employee's Microsoft 365 account: blocking sign-in, keeping the mailbox, OneDrive files and the licence.

4 min

When an employee leaves, their access to company data must end at exactly the right moment, but their e-mails and files must not be lost. The order below takes care of both. All steps are done in the Microsoft 365 admin center unless stated otherwise.

Timing and preparation

  • Agree with the manager exactly when access ends – usually at the end of the last working day, immediately if the departure is not amicable.
  • Decide in advance who takes over the mailbox and OneDrive files (usually the line manager or a replacement).
  • Get out the list of hardware issued to the employee.

A former employee's mailbox may contain personal messages. Only people who need it to continue the work should have access, and your internal rules should state how long a leaver's data is kept and when it is deleted.

1. Close access

  1. Block sign-in: Users → Active users → user → Block sign-in.
  2. Reset the password (Reset password) so the old one no longer works anywhere.
  3. End active sessions: in the same pane, Sign out of all sessions (in the Entra admin center: Revoke sessions). Without this, apps that are already open may keep working for a while.
  4. Remove MFA methods (Entra admin center → Users → user → Authentication methods), especially if the phone is the employee's own.
  5. Devices: collect the laptop and work devices. If they are in Intune, you can remotely Wipe a company phone or computer, or Retire a personal phone to remove only company data.

2. Mailbox and OneDrive files

There are two options, depending on how long mail will keep arriving:

  • Convert to a shared mailbox (Users → Active users → user → Mail → Convert to shared mailbox). A shared mailbox up to 50 GB needs no licence, all old mail is kept and the manager can be given access. Convert before removing the licence.
  • Forwarding and auto-reply. Forward new mail to a colleague and add an automatic reply saying the person no longer works there and who to contact instead.

A mailbox larger than 50 GB or a legal retention requirement (litigation hold) means keeping a licence – get advice here.

When you delete a user, the admin center offers to give their manager access to the OneDrive. A deleted user's OneDrive is kept for 30 days by default (adjustable in the SharePoint admin center), after which the files are permanently deleted. The safest approach is to move important files to a SharePoint team site or the manager's OneDrive before deleting the user.

3. Groups and licence

  1. Remove the user from Microsoft 365 groups, Teams teams and distribution lists. Check whether they were the only owner anywhere – if so, assign a new owner.
  2. Remove the licence (Licenses and apps) so it is freed for the next hire or you stop paying for it.
  3. Delete the user only once the mailbox and files are safely handed over. A deleted user can be restored within 30 days.

4. Everything else

Microsoft 365 is only part of the picture. Also review:

  • online banking and payment authorisations;
  • domain registrar, web hosting, web shop;
  • social media and advertising accounts (Facebook, Google, LinkedIn);
  • the password manager – remove the user and change the passwords they knew;
  • VPN, firewall accounts, Wi-Fi password, door and alarm codes;
  • supplier portals and accounting software.

When to call a professional

If the departure is contentious, the employee had admin rights or the mailbox is very large, it is worth doing the offboarding with a specialist so nothing slips through. ITABIKS does this as part of Microsoft 365 administration; for urgent cases call +372 53 888 229.

Was this article helpful?