Offboarding a leaver: their mailbox, OneDrive and access

Stop access at the right moment

Agree the exact time access ends with the manager, usually the end of the last working day or immediately for a sudden departure. At that time, block sign-in on the account, reset the password and choose the option to sign the user out of all sessions so phones and browsers that are already logged in stop working. Remove their registered multi-factor methods so the old phone cannot approve a sign-in.

Check for anything that would keep access going: app passwords, mail forwarding rules, delegated access they gave to someone else, devices registered to them and guest access they set up for outsiders. If the person used their own phone for work email, issue a selective wipe of company data through Intune where it is in place. Collect company laptops and phones and reset them before reissuing.

Decide what happens to their email

Clients and suppliers will keep emailing a leaver for months. The usual approach is to convert their mailbox to a shared mailbox and give the manager or the person taking over their work access to it. A shared mailbox under the size limit generally does not need a paid licence, and the history stays searchable. Add an automatic reply explaining who to contact instead.

Avoid simply forwarding a leaver's mail to their personal address or leaving the old account active indefinitely with a licence, which costs money and keeps a valuable account alive for attackers. If the mailbox is very large or must be kept for a set number of years, a retention policy or litigation hold can preserve it, but check licensing because some of these options require specific plans.

Do not lose their OneDrive

When a user account is deleted, their OneDrive is kept for a limited period before it is removed for good, and admins can configure how long. Many small businesses only discover this months later when they need a file that existed only in that person's OneDrive. Microsoft 365 can automatically grant the manager access to a deleted user's OneDrive, but only if the manager is set on the account.

The safer path is to go through the OneDrive before deleting the user. Have the manager or a colleague look through it with an admin's help and move anything the business needs into the right SharePoint library. Personal material can be left to expire. If you keep a Microsoft 365 backup, confirm it still holds a copy of the leaver's data for as long as your policy says.

Groups, Teams and shared things

Leavers often own things: Microsoft 365 groups, teams, SharePoint sites, shared calendars, Forms, Planner plans and Power Automate flows. If they are the only owner, nobody can manage those items after the account goes. Assign a new owner before removing the user. Check distribution lists they managed and any shared mailbox permissions so they come off cleanly.

Look outside Microsoft 365 too. Accounting software, CRM, bank portals, supplier websites, social media accounts and domain registrars may all have the leaver as a user or as the contact address. A simple offboarding checklist, kept with your onboarding checklist, makes sure nothing gets missed when the person in charge of offboarding changes.

Removing the licence and the account

Once the mailbox is converted and files are moved, remove the licence from the account so you stop paying for it, and reassign the licence to a new starter or reduce your subscription at renewal. Keep the user account itself blocked rather than deleted for a period if you may still need to reference it, then delete it according to your policy.

Record what was done and when: the time access was stopped, where the mail and files went, who received access and when the account was deleted. That record helps if a dispute arises later or if the former employee asks for their personal information under the Privacy Act 2020. It also gives the next person handling a departure a clear example to follow.

Respect privacy while keeping business records

Work mailboxes often contain some personal messages. Give the leaver a chance to remove clearly personal material before they go, and set expectations in your IT policy that work accounts belong to the business. Limit access to the shared mailbox to the people who need it for business continuity, rather than giving the whole team access to someone's history.

For sudden or difficult departures, act quickly on access but take extra care with the data, because it may be needed for an employment process. Preserve rather than delete, document what you did and get advice if the situation is contentious. A calm, consistent process protects both the business and the person leaving.