Offboarding staff from Microsoft 365

Day one: the account

Everything in this section is in the Microsoft 365 admin center or the Microsoft Entra admin center. Microsoft moves menus, so if a path doesn't match, search the admin centre for the setting's name.

1. Block sign-in. Microsoft 365 admin center → Users → Active users → the person → Block sign-in. This stops new sign-ins. It does not kick out the phone and laptop that are already signed in, so:
2. Revoke sessions and reset the password. Entra admin center → Users → the person → Revoke sessions, then reset the password to something long and random that nobody writes down. Devices that were signed in are forced out within about an hour as their tokens expire.
3. Remove their MFA methods. Same place, Authentication methods: delete the Authenticator entry and phone number. Otherwise the app on their personal phone remains a key to your business.
4. Wipe or retire the device. If you use Intune: Devices → the laptop or phone → Wipe for a company-owned device (full factory reset) or Retire for a personal phone (removes only the company apps and data). If you don't, the Exchange admin center can still wipe the mailbox off a phone. Get the laptop back, with the charger, and don't hand it to the next person until it's been reset.
5. Remove them from groups, Teams and shared mailboxes. Distribution lists, security groups, Microsoft 365 groups, shared mailbox members. If they own a Team, a SharePoint site or a group, transfer ownership first; a Team with no owner is a Team nobody can manage.
6. Check forwarding and inbox rules. Exchange admin center → Mailboxes → the mailbox → mail flow settings. Unhappy leavers and attackers both set up quiet forwarding to a personal address. Remove anything you didn't put there.
7. Change the passwords they knew. The Wi-Fi, the alarm code, the Xero login "everyone uses", the social media accounts, anything typed from memory rather than taken from a password manager. If that list is long, that's the argument for a password manager.

Keeping what matters

Email: convert the mailbox to a shared mailbox

Microsoft 365 admin center → Users → Active users → the person → Mail → Convert to shared mailbox. The address keeps receiving, all the old mail and calendar stays, and whoever is taking over the work gets access from their own account. A shared mailbox under 50 GB needs no licence, so once the conversion finishes you can remove the licence and stop paying. Keep sign-in blocked on the account behind it.

Two things to know. A mailbox over 50 GB can't be converted without keeping a licence on it, so check the size first. And a shared mailbox is a mailbox, not an archive: anyone with access can delete from it, and it isn't covered by Microsoft's backup unless you've set one up. Our backup guide covers what Microsoft keeps.

Or forward it, with an auto-reply

If nobody needs to read the old mail, the lighter option is forwarding: Users → the person → Mail → Email forwarding to a colleague, plus an automatic reply ("Sam has left; please contact accounts@…") set from the Exchange admin center. Forwarding only works while the mailbox exists, so you still need to convert it or keep it licensed. In practice, converting to shared and setting the auto-reply on the shared mailbox is the combination that lasts.

OneDrive: hand it over before you delete anything

Microsoft 365 admin center → Users → the person → OneDrive → Get access to files gives a named colleague a link to the whole OneDrive. Do this while the account still exists, then move anything the business relies on into SharePoint or a Team, where it belongs to the business rather than the person. When the account is eventually deleted, Microsoft keeps the OneDrive for 30 days by default (an admin can lengthen that in the SharePoint admin center) and emails the person's manager, if one is set in their profile. Thirty days goes quickly in a small business.

Teams chats

Channel conversations and files in Teams belong to the Team and stay. One-to-one chats don't transfer. If something important only exists in a private chat (a client's instructions, a site contact), ask the person to put it in the channel or an email before their last day. Recurring meetings they organised will need re-creating by someone else.

If the departure involves a dispute, a legal hold on the mailbox and OneDrive comes before any of this. Get advice first.

The rest of the business

Microsoft 365 is usually the smallest part of the list. Work through these the same day:

• Job or practice software (simPRO, Tradify, ServiceM8, AroFlo; Cliniko, Splose, Halaxy): deactivate the user rather than deleting them so job and appointment history survives, and reassign their open jobs or clients.
• Xero or MYOB: remove the user. If they could approve payments or see the bank feed, tell the bank and the bookkeeper the same day.
• Bank and payment portals: remove them as an authorised user, cancel any card in their name, and check whether they were a second approver on anything.
• Google and social accounts: Google Business Profile managers, Google Ads, the Facebook Page, Instagram, LinkedIn page admins. Make sure the business still has an owner on each who isn't them.
• Domain, website and hosting: the registrar, DNS and hosting logins should be in the business's name. If they're in the leaver's personal email, moving them is urgent.
• The password manager: remove them from the team vault, which ends their access to every shared login at once. Rotate the passwords in the collections they could see, starting with banking, email and anything with a card attached.
• Phones and numbers: keep the business mobile number (port it to a new SIM rather than cancelling), update call forwarding, voicemail, the website and any shared email signatures.
• Physical: keys, fobs, vehicle, uniform, business cards, and any client site inductions or contractor portals they hold in your name.

What not to do

• "Just leave the account unlicensed." Microsoft keeps the mailbox for 30 days after the licence comes off, then deletes it permanently. The OneDrive lingers longer but goes read-only and is eventually archived, with charges to store and retrieve it. An unlicensed account isn't an archive; it's a countdown.
• Don't delete the account on day one. There's a 30-day restore window, but conversion to a shared mailbox and the OneDrive handover both need the account to exist. Block sign-in on day one; delete when the handover is finished.
• Don't keep it licensed "so we can get in". A licensed, un-blocked account is a monthly fee and an open door. Convert it instead.
• Don't pass their password around so someone can "check their email". That's what shared mailbox access is for, and it leaves a record of who read what.
• Don't forget the phone. Blocking sign-in without clearing MFA methods and revoking sessions leaves a signed-in Outlook app working for hours.

The checklist

Print this page; the table holds up on paper. Tick it off the same day, and keep the ticked copy with the person's file.

Onboarding is the mirror

Every item above is something that was set up when the person started. If you write it down on the way in (the account, the groups, the shared mailboxes, the vault collections for their role, the software seats, the laptop and phone), offboarding is a list to tick, not an investigation. Keep a one-page record per person. We keep that record in the customer portal for every business we look after, which is what makes a leaver a 20-minute job rather than a worried afternoon.

Where we fit

Offboarding and onboarding are part of every managed IT support plan we run. You raise it in the portal with the name and the last day; we do the Microsoft 365 steps on time, chase the rest of the list with you, and send back the ticked checklist. If you've already had a leaver and aren't sure what was done, ask us and we'll check.