Offboarding a user in Microsoft 365 the right way

Microsoft's own guidance for removing a former employee runs in stages: secure the account, preserve data, give others access, then remove licences and the account. The common mistake is doing the last step first. If you delete the user before a hold or retention policy applies, the mailbox is gone after the soft-delete window and cannot become an inactive mailbox.

Do the steps below in order. Where the departure is contentious (a dismissal, a suspected data theft, a move to a competitor), pause after step 2 and talk to counsel before anything is changed or handed over.

1. 01

   Block sign-in

   In the Microsoft 365 admin center or Microsoft Entra ID, block the account. This stops new sign-ins.

2. 02

   Revoke sessions

   Blocking does not end sessions already open. Revoke sign-in sessions (in Entra ID, or with the Revoke-MgUserSignInSession PowerShell cmdlet) so existing refresh tokens stop working.

3. 03

   Reset the password

   Set a long random password, so the old one cannot be reused anywhere it was synced or saved.

4. 04

   Remove MFA methods and app passwords

   Delete registered phones, authenticator apps and passkeys so the account cannot be re-registered from the person's device.

5. 05

   Disable devices

   Disable the user's devices in Entra ID and, for company devices, retire or wipe in Intune once data is preserved. For personal phones, issue an Intune selective wipe of work apps.

Decide what must be kept before you change anything else. If your organization already applies a Microsoft 365 retention policy to all mailboxes, the mailbox will be preserved when the account is deleted. If not, apply a hold or a retention policy to this mailbox now.

Microsoft explains that if a hold is applied before the account is deleted, the mailbox becomes an inactive mailbox and its contents stay searchable for the retention period. Microsoft recommends confirming the hold is applied before removing the account. For litigation or investigations, use an eDiscovery hold that also covers the user's OneDrive.

• Confirm the hold or retention policy shows on the mailbox before going further.
• Note the date, who applied it and why. That record helps later if the preservation is questioned.
• For possible litigation, consider a forensic copy of the laptop before it is reissued.

Clients will keep emailing the person for months. Options: convert the mailbox to a shared mailbox and grant the manager access; forward new mail to a colleague; or set an automatic reply naming a new contact. Microsoft notes that a shared mailbox does not need a licence while it is under 50 GB; above that, or if it needs an archive or a hold that depends on licensing, check your licence requirements.

Check for and remove inbox rules and external forwarding the person set up. Unknown forwarding to a personal address is a common sign of data leaving with an employee.

Give the manager access to the leaver's OneDrive and ask them to move what the business needs into a team site, not their own OneDrive. Microsoft's default is that after the user is deleted, the person given access has 30 days to collect files; admins can change the retention for deleted users' OneDrive to between 30 and 3,650 days in the SharePoint admin center.

Retention policies and holds override this: content under a hold is kept regardless. OneDrive accounts left unlicensed are moved to an archived state after 93 days, so do not leave accounts unlicensed indefinitely as a substitute for a decision.

• Recover laptops, phones, tokens and keys; record serial numbers against the asset register.
• Remove the user from groups, Teams, distribution lists and shared mailbox permissions.
• Transfer ownership of Teams, SharePoint sites, Power Automate flows and Forms they own.
• Revoke access to systems that don't use Microsoft sign-in: accounting, practice management, banking, VPN, building access, password manager vaults.
• Rotate shared passwords the person knew.

Only once data is preserved and handed over, remove licences and, when you are ready, delete the account. Microsoft keeps deleted users in the admin center for 30 days, so a mistake can still be reversed in that window. Document the completion date in your offboarding record.

When a departure is hostile, or you suspect data theft, the order changes slightly: preserve first, then cut access at the moment of the conversation. Take a forensic image of the laptop before it is reissued, export the audit log for the user's recent activity, and record mailbox rules and forwarding as you find them. Do not let well-meaning colleagues browse the mailbox or OneDrive; every access becomes something to explain later. Our departing employee investigation team can collect this with chain of custody if the matter may end up in court.