Employee offboarding: secure Microsoft 365 without losing data

Treat a departure as a security change

Deleting the account when HR submits the ticket can interrupt email, make files inaccessible and break business processes. Keeping it active so a manager can recover documents creates exposure. A sound process blocks the identity at the agreed time, then manages continuity and retention with named owners.

This guide covers routine and urgent departures. It does not replace a compromise investigation or a legal retention decision. Access to content must be authorized, limited and recorded; never give the departing employee's password to their replacement.

• Microsoft — Remove a former employee ↗

Before departure: define scope and ownership

• Confirm the exact account, effective time and timezone, manager, HR owner and urgency.
• Identify cloud-only or AD-synchronized identity and the source of authority.
• Inventory administrative roles, groups, delegated mailboxes, SaaS, devices, VPN and local access.
• Name replacement owners for Teams, SharePoint sites, flows, applications, scheduled tasks and subscriptions.
• Decide how email and files will be used, retained and backed up, with authorized recipients and deadlines.
• Confirm retention obligations with responsible staff before deletion or license removal.

1. Block sign-ins and revoke sessions

At the effective departure time, disable the Entra account and revoke sessions. For a hybrid identity, also disable the source AD account and verify synchronization. Reset credentials at the correct authority through an approved process, without putting them in a ticket or script.

Revocation is not universal immediate logout. Access tokens can remain usable until expiry or supported CAE evaluation. SaaS applications can keep their own session cookies; remove access, deprovision the user and terminate application sessions where supported. Handle active VPN sessions at the gateway too.

$Upn = 'leaver@contoso.com'
Connect-MgGraph -Scopes 'User.ReadWrite.All','User.RevokeSessions.All' -NoWelcome
$user = Get-MgUser -UserId $Upn -Property Id,UserPrincipalName,AccountEnabled,OnPremisesSyncEnabled
$user | Select-Object Id,UserPrincipalName,AccountEnabled,OnPremisesSyncEnabled

# Blocks new sign-ins; also verify the AD source for hybrid identities
Update-MgUser -UserId $user.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $user.Id
Get-MgUser -UserId $user.Id -Property UserPrincipalName,AccountEnabled |
  Select-Object UserPrincipalName,AccountEnabled

• Microsoft — Revoke access and understand its limits ↗

2. Handle devices and access beyond Microsoft 365

Recover laptops, phones, physical keys and authentication hardware. Distinguish a corporate device to reset from a personal device where only managed data should be removed. Intune Wipe, Retire and selective removal have different effects and depend on platform, enrollment and connectivity.

Do not automatically disable every device owned by the user: some may be shared or assigned to someone else. Verify use and assignment. Deleting an Entra or Intune object proves neither disk erasure nor removal of downloaded files.

• Remove SaaS assignments and verify SCIM deprovisioning, then review application-local accounts.
• Terminate VPN sessions and retire relevant certificates or remote access.
• Remove active and eligible privileged roles, delegations and access to secret stores.
• Rotate shared secrets actually known by the leaver after dependency analysis.
• Transfer scheduled work and application identities to named owners; avoid critical jobs tied to personal accounts.

• Microsoft — Intune remote device actions ↗

3. Inventory the mailbox before conversion

Review size, archive, retention, rules, forwarding and delegates. Existing inbox rules survive conversion to a shared mailbox, so inspect external forwarding and unexpected behaviour.

Access to a former employee's mail must follow organizational policy and applicable HR or legal authorization. Prefer a recorded delegation with an expiry over permanent access for the whole team.

$Mailbox = 'leaver@contoso.com'
Connect-ExchangeOnline -ShowBanner:$false
Get-Mailbox -Identity $Mailbox | Format-List RecipientTypeDetails,ArchiveStatus,
  LitigationHoldEnabled,InPlaceHolds,RetentionPolicy,
  ForwardingAddress,ForwardingSmtpAddress,DeliverToMailboxAndForward
Get-MailboxStatistics -Identity $Mailbox | Select-Object DisplayName,TotalItemSize,ItemCount
Get-InboxRule -Mailbox $Mailbox -IncludeHidden |
  Select-Object Name,Enabled,ForwardTo,RedirectTo,DeleteMessage,MoveToFolder
Get-MailboxPermission -Identity $Mailbox |
  Where-Object { -not $_.IsInherited } |
  Select-Object User,AccessRights,Deny
Get-RecipientPermission -Identity $Mailbox | Select-Object Trustee,AccessRights

4. Choose a shared or inactive mailbox

Convert while the mailbox still has a license. An unlicensed shared mailbox has a 50 GB limit; 100 GB requires Exchange Online Plan 2. Archive, hold and compliance features can require specific licensing: check every requirement before removing a product. Delegates also need appropriate rights and licenses.

Do not delete the account anchoring a shared mailbox. Keep sign-in blocked: conversion alone does not prevent authentication. In hybrid Exchange, align the recipient type at the source so synchronization cannot reverse the conversion.

$Mailbox = 'leaver@contoso.com'
$Delegate = 'manager@contoso.com'
# After inventory, authorization and license validation
Set-Mailbox -Identity $Mailbox -Type Shared
Add-MailboxPermission -Identity $Mailbox -User $Delegate `
  -AccessRights FullAccess -InheritanceType All -AutoMapping:$false
# FullAccess does not grant Send As; add it only if approved
Get-Mailbox -Identity $Mailbox | Select-Object RecipientTypeDetails
Get-MailboxPermission -Identity $Mailbox -User $Delegate

• Microsoft — Convert a user mailbox to a shared mailbox ↗
• Microsoft — Create and manage inactive mailboxes ↗

5. Confirm retention before deletion

Prepare an inactive mailbox by applying compatible retention or a hold with the required license, then wait for effective application before deleting the account. The Exchange MRM RetentionPolicy property alone does not prove a mailbox will become inactive. Confirm Purview scopes and actual holds with compliance staff.

Record mailbox identifiers, policy, duration, authorized people and recovery mechanism. Retention can depend on item creation or receipt rather than the departure date. An inactive mailbox is not a shared mailbox for processing new mail.

• Microsoft — Retention policies and labels ↗

6. Transfer OneDrive through a deliberate process

Before removing the license, inventory business folders, links, shared files and unsynchronized data. Give an authorized successor temporary access, then move team documents to a SharePoint library with durable ownership. Validate versions, permissions, links and processes using the old path: a copy can change these properties.

User deletion starts the OneDrive lifecycle configured in SharePoint, separate from the Entra account's 30-day recovery window. Do not assume all data disappears or remains available at the same time. Purview policies and holds can change retention behaviour.

Removing the license while retaining the identity is not free indefinite storage. Under current default settings, OneDrive becomes read-only after 60 unlicensed days and archived after 93. Paid storage options and cloud or offering exceptions exist; inspect OneDrive Accounts reports and tenant settings.

The policy effective July 1, 2026 also introduces a 365-day cumulative nonpayment clock for certain unlicensed accounts. Recovery can require licensing or paid reactivation. Transfer data before deadlines and verify actual rules rather than relying on the archive.

• Microsoft — Access a former employee's OneDrive and Outlook data ↗
• Microsoft — OneDrive retention and deletion ↗
• Microsoft — Unlicensed OneDrive accounts ↗

7. Reassign business resources and delegations

Group membership does not cover every permission. Direct grants, SaaS accounts, local files, services and API keys require separate review. For critical services, name a primary and backup owner and record a successful test.

• Teams and Microsoft 365 groups: add an active owner and review private/shared channels and important meetings.
• SharePoint: review site owners, direct permissions and links; team files are not automatically transferred with an account.
• Power Automate and Power Apps: transfer ownership and check every connection, license and personal dependency.
• Entra applications: replace owners and contacts and review known secrets/certificates; applications may continue independently of the user session.
• Mailboxes and calendars: remove FullAccess, Send As and Send on Behalf granted to the leaver on other mailboxes.
• Reports, subscriptions and scheduled jobs: test using the replacement identity before closing the ticket.

• Article — Audit OAuth apps and Graph permissions →

8. Remove licenses and delete at the right time

Remove licenses after validating data, features and successors. Review direct and group-based assignments: removing a direct assignment does not necessarily remove a group license. Evaluate every product in the subscription, not only Exchange.

A shared mailbox still in use keeps its disabled anchor account. When deletion is approved, document recovery windows and active protections. Restoring an account within 30 days does not replace tested retention and backup plans.

• Microsoft — Remove a former employee's licenses ↗
• Microsoft — Delete a former employee ↗

Exit checks and a sample case record

Fictional example: an employee leaves Friday at 5 p.m. The account is blocked and sessions revoked at that time; the 18 GB mailbox is converted and the manager receives FullAccess for 30 days. Archive and retention requirements are checked before license savings. Team folders move to SharePoint with link testing; a separate task removes delegation after transition.

If the departure is cancelled, restore access only after renewed authorization, verify licenses and AD authority and test applications. Reverting a shared mailbox to a user mailbox requires appropriate licensing. Do not automatically restore all historical privileges.

Permissions, auditability and professional support

Graph examples require delegated scopes and an appropriate Entra role; consent alone does not grant every power, especially over a privileged identity. Exchange has RBAC, SharePoint has administrative roles and Purview has compliance permissions. Use named administrative accounts, PIM where available and task-appropriate rights.

Inventory commands read configuration; block, revoke, conversion and delegation examples modify it. Execute them separately after validating account and ticket. Protect exports and minimize personal data.

Microsoft 365 consulting helps formalize the process, identify overlooked dependencies and test retention. The goal is a reusable procedure with owners and evidence, adapted to licensing and the hybrid environment.

• Service — Microsoft 365 security assessment →
• Article — First response to a compromised account →