An employee is leaving: Microsoft 365 steps in the right order
Close the account too slowly and it is a security risk. Delete it too fast and you lose email and files. Here is the order that keeps both safe.
When someone leaves a small business, their Microsoft 365 account is often the last thing anyone thinks about. It gets left open for weeks, or deleted in a hurry, and both cause problems. An open account is a way in for a former employee or anyone who has their password. A deleted one can take customer emails and files with it. Here is the order that works, written for the office manager or owner who has admin rights but isn't an IT specialist.
Before the last day
- Agree who takes over. Name the colleague who will watch the person's email and inherit their files. Decide it now, not after the account is locked.
- List what they have access to. Shared mailboxes, Teams channels, SharePoint sites, and the business apps they sign in to with their Microsoft account, such as accounting, CRM or e-signature tools. Ask the person directly. They know better than anyone.
- Ask for passwords they hold for the business. Supplier portals, social media, the domain registrar. Change each one after they leave, then store it in a shared password manager rather than a spreadsheet.
- Plan the return of devices. Company laptop, phone, security keys. If a laptop is encrypted with BitLocker, make sure you can find its recovery key before the person goes.
On the day they leave
Do these in the Microsoft 365 admin center, in this order, ideally at the moment the person finishes:
- Block sign-in. Under Users, then Active users, select the person and choose to block sign-in. This stops new logins without deleting anything.
- Reset the password. This adds a second lock and makes sure an old password written down somewhere is useless.
- Sign them out everywhere. Blocking sign-in doesn't immediately end sessions that are already open on a phone or a home computer. Use the option to sign the user out of all sessions so those have to log in again, and fail.
- Remove their sign-in methods. Delete the authenticator app and phone numbers registered for multi-factor authentication, so nobody can use them to reset the account later.
- Check forwarding and inbox rules. Look for mail forwarding to an outside address and any rules that move or delete messages. These are easy to miss and are a common way company mail keeps leaking after someone has gone.
- Remove admin roles and group memberships they no longer need, including any distribution lists that send them customer mail.
If the departure is difficult, do the first three steps before the conversation, not after it.
Keeping their email
Customers will keep writing to the old address for months. The usual answer is to convert the mailbox to a shared mailbox and give the colleague who is taking over access to it. The old emails stay, new ones keep arriving, and you can set an automatic reply that points people to the right contact.
Do this before you remove the person's license. If you take the license away first, Microsoft treats the mailbox as unlicensed and deletes it after a grace period. A shared mailbox generally doesn't need its own license, but there are exceptions, for example if it has to keep an archive or a legal hold, so check Microsoft's current rules for your plan.
Keeping their files
Files saved in the person's OneDrive belong to the business, but they live under that user's account. When the account is deleted, Microsoft keeps the OneDrive for a limited retention period and then removes it. The admin center lets you give another user access to a departing user's OneDrive. Use that to move anything the business needs into a SharePoint site or a shared Teams folder, where it doesn't depend on any one person. Don't rely on the retention period as your only copy.
This is also a good moment to check your backup covers Microsoft 365 itself, not just the office computers. Microsoft keeps the service running. Keeping your own copy of your data is up to you.
Licenses, devices and the final delete
- Licenses. Once mail and files are handled, remove the license and either give it to a new hire or reduce the number on your subscription. An unused license stays on the bill until you change the count.
- Devices. When the laptop and phone come back, check that company data has been removed from personal phones that had Outlook or Teams. If your devices are managed through Microsoft Intune, you can remove company data remotely. Reset the laptop before giving it to someone else.
- Deleting the user. Wait until the mailbox is converted, the files are moved, and you're sure nothing else depends on the account. A deleted user can be restored for 30 days, but don't plan around that.
Make it a checklist, not a memory
The businesses that get this right aren't more technical than others. They just use the same written checklist every time and note who did each step and when. If you'd like help writing one for your own setup, or a review of accounts that should have been closed long ago, our password and account security and managed IT services pages explain how we can help. If you're changing IT company at the same time, our IT provider handover checklist covers the admin accounts side.
Call (213) 986-4855 to talk it through.