Guide
How to offboard a Microsoft 365 user safely
Disabling an account is the easy part. The mistakes happen in the order of everything else: removing a license before the mailbox is sorted, or leaving a team without an owner. This is a checklist in a safe order, with the reason for each step.
1. Decide what must be kept
Before you touch anything, decide what survives: the mailbox, the OneDrive files, group and Teams ownership, and any legal obligation. Ask the person’s manager and, if there is any chance of a dispute or an investigation, your legal or HR contact. Some steps below (litigation hold in particular) should only happen with their agreement.
2. Stop sign-in, including sessions that are already open
- Disable the account so no new sign-ins succeed.
- Revoke sign-in sessions. Disabling does not always end a session that is already signed in, so revoke existing sessions as well.
- Remove or reset MFA methods if the account might be handed to someone else or reactivated later, so the old person’s phone cannot approve prompts.
3. Deal with the mailbox before you remove the license
This is the order that matters most. When you remove a license, Microsoft starts a grace period (about 30 days) after which the mailbox and OneDrive data can be deleted. So decide first:
- Keep the mail: convert the mailbox to a shared mailbox and give the manager or a delegate access. A shared mailbox generally does not need its own license, unless it is very large or has features such as litigation hold or an online archive. Check Microsoft’s current limits for your plan.
- Handle incoming mail: set an out-of-office reply, or forward new mail to the manager for a defined period.
- Hide the person from the shared address book so colleagues stop emailing them.
- Legal hold only where your legal team requires it, and write down who asked for it.
If a shared-mailbox conversion is still in progress, wait for it to finish. Removing the license in the middle puts the mailbox at risk.
4. Hand over files and ownership
- OneDrive: give the manager access, or set a retention period for the files, before the account is deleted.
- Groups and Teams: find every group and team the person owns and assign a new owner. A team with no owner is a common source of orphaned content.
- Remove the person from groups once ownership is handled. Write down the full list first, because you may need it if the account is reactivated.
5. Tidy the profile
Clear the manager field and, if it helps your team, add a prefix to the display name (for example “Z-Leaver”) so leavers sort together and are obvious in a picker.
6. Remove the license last
Once the mailbox and files are handled, remove the licenses so the seats return to your pool. If the license comes from a group (group-based licensing), remove the person from that group instead of trying to remove the license directly.
7. Keep a record
Write down what you did, when, and who asked for it: which steps ran, which failed, and what was removed. When someone asks six months later “what happened to that mailbox?”, you want an answer that is not from memory.
Common ways this goes wrong
- License removed first. The mailbox enters its grace period before it was converted or exported.
- Only the account was disabled. An open session, an app password or a forwarding rule keeps working.
- A team loses its only owner. Nobody can manage it, and nobody notices until something breaks.
- No record. Nothing shows who removed what.