Home  /  Guides  /  Microsoft 365 Offboarding Checklist
O365 Admin

What happens to email and files when an employee leaves

Most small businesses have no leaver process. They change the password and hope. That is how ex-staff keep reading email for a fortnight, how a leaver's OneDrive quietly deletes itself, and how you end up paying for a licence nobody uses. Here is the whole thing, in order.

Someone hands in their notice. On their last day the owner changes the password, and that is the end of it as far as anyone in the office is concerned. Two months later nobody can find the quote they sent to a customer, the mailbox is still being paid for, and their OneDrive quietly deleted itself thirty days after the account was removed.

None of that is bad luck. It is what happens when there is no process. This is the process. It takes about twenty minutes if you have done it before.

Do these on the last day

The order matters. Cutting access comes first, because everything else can wait and this cannot.

  1. Block sign-in. In the Microsoft 365 admin centre, open the user and set sign-in status to blocked. Do not delete the account. Blocking is instant and reversible; deleting starts a countdown on their data.
  2. Reset the password. Blocking stops new sign-ins, but a password reset closes the door on anything holding old credentials.
  3. Revoke active sessions. This is the one almost everybody misses. A blocked account can still have live tokens on a phone or a browser that keep working for hours. In the admin centre there is a sign out of all sessions option on the user. Use it.
  4. Remove their MFA methods. Their personal phone should not be a factor on a company account any more.
  5. Take them out of any admin roles. If they were a global administrator, do this before anything else, not after.
  6. Retire or wipe company devices. If you use Intune, retire removes company data and leaves personal data alone, which is the right choice for a phone the person owns. Wipe is for a company laptop.
The bit people get wrong

Changing the password on its own does very little. If the session is still live on their phone, they can read email on the train home. Block, reset, and revoke sessions. All three.

What to do with the mailbox

You almost never want to delete it. Customers will keep emailing that address for months, and at some point somebody will need to find an old thread.

The right answer for most small businesses is to convert it to a shared mailbox. A shared mailbox does not need a licence as long as it stays under the size limit Microsoft allows, so the mailbox stays fully searchable and you stop paying for that user. You then give access to whoever is picking up the work, and it appears in their Outlook alongside their own inbox.

The sequence is: block sign-in, convert to shared, grant access to the right person, then remove the licence. Do it in that order. If you strip the licence first, you are on a clock before the mailbox goes.

Auto-forwarding to a colleague instead is tempting and usually a mistake. It is invisible to everyone, it never gets turned off, and two years later a former employee's name is still arriving in somebody's inbox with no explanation. A shared mailbox is honest about what it is.

What to do with their files

This is where the real damage happens, because the clock is short and silent.

When you delete a user account, their OneDrive is kept for a limited retention period and then removed. The default is not long, and nobody gets a reminder. If that person kept anything important in OneDrive rather than in a shared SharePoint library, and they usually did, it goes.

So before you delete anything:

Teams chats are a separate question. One to one chat history belongs to the individual and is not somewhere you should be storing anything the business needs. Channel conversations stay put, because they live with the team rather than the person.

Stop paying for them

Once the mailbox is shared and the files are moved, remove the licence. That is real money: a licence you are not using is a bill every month for nothing.

Two things to check at the same time. First, whether the licence is on an annual commitment, because you may be able to reduce your seat count only at renewal. Second, whether they were the named contact or billing owner on anything: the domain registrar, the phone system, the accounting software, the card machine. That is the one that bites six months later when a renewal email goes to an address nobody reads.

Things that go wrong

The short version

If you print one thing and stick it in the staff file, print this.

  1. Block sign-in, reset password, revoke sessions.
  2. Remove MFA methods and admin roles.
  3. Retire or wipe company devices.
  4. Convert the mailbox to shared and give access to the right person.
  5. Review OneDrive, move anything the business needs to SharePoint.
  6. Remove the licence.
  7. Change any non-Microsoft accounts they held, and update billing contacts.
  8. Diary a review in 90 days to delete what is genuinely no longer needed.

If you are not sure your Microsoft 365 is set up so that any of this is straightforward, that is usually a sign the original build was rushed. Our Microsoft 365 Setup service sorts the structure out, and the security audit guide covers how to find dormant accounts you have forgotten about.

Common questions

Can I just change the password when someone leaves?

No. A password change does not end sessions that are already signed in, so a phone or browser can keep working for hours. Block sign-in, reset the password and revoke active sessions. All three, on the last day.

Do I have to keep paying for a leaver's mailbox?

No. Convert the mailbox to a shared mailbox first, then remove the licence. A shared mailbox does not need a licence while it stays within Microsoft's size limit, so the email stays searchable and the monthly cost stops.

What happens to their OneDrive files if I delete the account?

OneDrive is kept for a limited retention period after the account is deleted, then removed. Nobody is reminded. Review the OneDrive and move anything the business needs into SharePoint before you delete anything.

Should I forward their email to a colleague instead?

Usually not. Forwarding is invisible, never gets switched off, and means a former employee's name keeps arriving in somebody's inbox. A shared mailbox does the same job and is obvious to everyone.

Want this set up properly once?

We sort the structure out so leavers, joiners and shared mailboxes are a five minute job rather than a panic. Fixed price agreed in writing first.

See Microsoft 365 Setup

Tags: Microsoft 365 · Offboarding · Exchange Online · OneDrive · UK SME

More in this series: all Klariq guides.