Most small businesses have no leaver process. They change the password and hope. That is how ex-staff keep reading email for a fortnight, how a leaver's OneDrive quietly deletes itself, and how you end up paying for a licence nobody uses. Here is the whole thing, in order.
Someone hands in their notice. On their last day the owner changes the password, and that is the end of it as far as anyone in the office is concerned. Two months later nobody can find the quote they sent to a customer, the mailbox is still being paid for, and their OneDrive quietly deleted itself thirty days after the account was removed.
None of that is bad luck. It is what happens when there is no process. This is the process. It takes about twenty minutes if you have done it before.
The order matters. Cutting access comes first, because everything else can wait and this cannot.
Changing the password on its own does very little. If the session is still live on their phone, they can read email on the train home. Block, reset, and revoke sessions. All three.
You almost never want to delete it. Customers will keep emailing that address for months, and at some point somebody will need to find an old thread.
The right answer for most small businesses is to convert it to a shared mailbox. A shared mailbox does not need a licence as long as it stays under the size limit Microsoft allows, so the mailbox stays fully searchable and you stop paying for that user. You then give access to whoever is picking up the work, and it appears in their Outlook alongside their own inbox.
The sequence is: block sign-in, convert to shared, grant access to the right person, then remove the licence. Do it in that order. If you strip the licence first, you are on a clock before the mailbox goes.
Auto-forwarding to a colleague instead is tempting and usually a mistake. It is invisible to everyone, it never gets turned off, and two years later a former employee's name is still arriving in somebody's inbox with no explanation. A shared mailbox is honest about what it is.
This is where the real damage happens, because the clock is short and silent.
When you delete a user account, their OneDrive is kept for a limited retention period and then removed. The default is not long, and nobody gets a reminder. If that person kept anything important in OneDrive rather than in a shared SharePoint library, and they usually did, it goes.
So before you delete anything:
Teams chats are a separate question. One to one chat history belongs to the individual and is not somewhere you should be storing anything the business needs. Channel conversations stay put, because they live with the team rather than the person.
Once the mailbox is shared and the files are moved, remove the licence. That is real money: a licence you are not using is a bill every month for nothing.
Two things to check at the same time. First, whether the licence is on an annual commitment, because you may be able to reduce your seat count only at renewal. Second, whether they were the named contact or billing owner on anything: the domain registrar, the phone system, the accounting software, the card machine. That is the one that bites six months later when a renewal email goes to an address nobody reads.
If you print one thing and stick it in the staff file, print this.
If you are not sure your Microsoft 365 is set up so that any of this is straightforward, that is usually a sign the original build was rushed. Our Microsoft 365 Setup service sorts the structure out, and the security audit guide covers how to find dormant accounts you have forgotten about.
No. A password change does not end sessions that are already signed in, so a phone or browser can keep working for hours. Block sign-in, reset the password and revoke active sessions. All three, on the last day.
No. Convert the mailbox to a shared mailbox first, then remove the licence. A shared mailbox does not need a licence while it stays within Microsoft's size limit, so the email stays searchable and the monthly cost stops.
OneDrive is kept for a limited retention period after the account is deleted, then removed. Nobody is reminded. Review the OneDrive and move anything the business needs into SharePoint before you delete anything.
Usually not. Forwarding is invisible, never gets switched off, and means a former employee's name keeps arriving in somebody's inbox. A shared mailbox does the same job and is obvious to everyone.
We sort the structure out so leavers, joiners and shared mailboxes are a five minute job rather than a panic. Fixed price agreed in writing first.
See Microsoft 365 SetupMore in this series: all Klariq guides.