How to offboard an employee in Microsoft 365

The checklist

1. 1

   Block sign-in

   In the Microsoft 365 admin center or Entra, block the account so the password stops working.

2. 2

   Revoke sessions

   Blocking sign-in doesn't end sessions that are already open. Revoke them so phones and browsers are signed out.

3. 3

   Reset the password and remove MFA methods

   A known phone or authenticator app shouldn't be a way back in.

4. 4

   Convert the mailbox to shared

   A shared mailbox keeps the mail without a license, as long as it stays under Microsoft's size limit for unlicensed shared mailboxes. Give the manager access.

5. 5

   Forward mail or set an automatic reply

   So customers and suppliers reach the right person.

6. 6

   Hand over OneDrive

   Give the manager access to the person's OneDrive and move anything important before the account is eventually removed.

7. 7

   Remove from groups, Teams and shared resources

   Including distribution lists and any admin roles.

8. 8

   Wipe or retire devices

   If devices are managed in Intune, retire or wipe company data from them.

9. 9

   Remove licenses

   Once the mailbox is converted, remove licenses so you stop paying for them.

Doing it with TenantWard

The offboarding runbook does each of these with a button, in order, on the person you pick. You confirm by typing their email, TenantWard saves their settings first, and every step is recorded with an undo.

Questions

Should I delete a leaver's Microsoft 365 account?

Not straight away. Block and convert first so mail and files are preserved. Deleted accounts can be restored for 30 days, after which data is gone unless it's covered by retention.

Does converting to a shared mailbox keep the email?

Yes. The mailbox and its contents stay; it just no longer needs a license, within Microsoft's size limit for shared mailboxes.