Why the order matters
There are three goals when someone leaves: stop their access, keep the business information they hold, and stop paying for their licence. Getting the order wrong causes trouble. Deleting the account first can lose the mailbox and OneDrive after the recovery period. Removing the licence before deciding what to keep can start the clock on data deletion. Leaving everything untouched keeps paying for a licence and leaves an active account that an attacker could use.
Former staff accounts that stay active are a favourite target, because nobody notices odd activity on a mailbox no one reads. A written checklist, followed every time, fixes this. It does not need to be long. What matters is that the person handling HR and the person handling IT agree on the steps and the timing, especially for departures that are not on good terms.
Day one: block access
On the person's last day, or immediately for an unplanned departure, block sign-in for their account, reset the password and sign them out of all sessions. Remove their multi-factor methods and any app passwords. Collect company devices such as laptops, phones and keys, and check whether they had admin access to any other systems such as your website, accounting software or social media accounts. Do not forget shared credentials the person knew, such as the alarm code, the Wi-Fi password or a supplier portal login. Change any that matter. Business owners often find the risky access is not in Microsoft 365 at all but in a supplier portal nobody remembered.
Email: shared mailbox or forwarding
Customers and suppliers will keep emailing the person for weeks or months. The usual answer is converting their mailbox into a shared mailbox and giving their manager or replacement access. All past email stays in place, new email keeps arriving and can be dealt with, and a shared mailbox under its size threshold does not need a licence. An automatic reply can tell senders the person has left and who to contact instead.
If the mailbox is larger than the shared mailbox threshold, or must be kept for legal reasons, options include a retention policy or a hold before removing the licence, or keeping a lower-cost licence on the account. Check what your plans include and your record-keeping obligations before choosing. Remove the shared mailbox once enquiries have died down and records requirements are met.
OneDrive, Teams and files
The person's OneDrive often holds client files, drafts and working documents that never made it to a shared location. When an account is deleted, Microsoft can give the manager access to that OneDrive for a limited period before it is removed. Better practice is to review the OneDrive before the account is deleted and move anything the business needs into the right SharePoint or Teams location.
Check Teams too. If the person owned teams, make sure each one has another owner. Files they shared in chats live in their OneDrive and can disappear with it. Recurring meetings they organised will need to be recreated by someone else, and any Forms, Planner plans or Power Automate flows owned by them should be transferred.
Removing the licence and reusing it
Once email and files are handled, remove the licence. If you are hiring a replacement soon, reassign the licence to the new person rather than buying another. If not, reduce your licence count. Annual licences may not be reducible until the renewal date, so note when your term ends and right-size then. Month-to-month licences can usually be reduced straight away.
Look at add-ons as well. A departed staff member may hold a Visio, Project, Teams Phone or Copilot licence that nobody else needs. These are easy to miss because they appear as separate lines on the invoice. A quarterly look at assigned licences against the current staff list stops paying for people who left months ago.
Final clean-up
After the retention period, delete the account. Record what was done and when: access blocked, data transferred, licence removed, account deleted. That record helps if a former employee later disputes anything, and it gives a clear trail for privacy obligations under the Privacy Act 2020, including what personal information the business still holds about the person and their clients. Finally, use each departure to improve the checklist. If something was missed, such as a forgotten supplier login, add it. Over time the process becomes quick and reliable, and the same steps, reversed, become your onboarding checklist for new starters.
In short
- Block sign-in and reset the password on the last day.
- Convert the mailbox to a shared mailbox so email and history are kept.
- Review OneDrive and transfer Teams ownership before deleting the account.
- Remove or reassign the licence and check add-ons on the invoice.