How to Offboard an Employee in Microsoft 365: A Small-Business Checklist (2026)

By Justin N. · Updated 2026-10-22 · This page may contain affiliate links

When someone leaves, you have two jobs: lock them out quickly, and keep the email and files the business still needs. Microsoft 365 gives you about 30 days of grace after you delete an account. This checklist is the order I'd do things in so nothing important falls through that gap.

Who this is for: a 5–50 person business with cloud-only Microsoft 365 accounts. If your accounts sync from an on-premises Active Directory, Microsoft says you must disable and delete them there instead, or the sync will undo your changes (Remove a former employee). Steps were checked against Microsoft Learn on 2026-10-22.

The checklist at a glance

Reset the password, then Sign out of all sessions, then Block sign-in.
Remove or reset their MFA methods and remove them from admin roles and groups.
Retire or wipe their devices in Intune (or Exchange, for phones that only have email).
Convert the mailbox to a shared mailbox (or set up forwarding).
Move the OneDrive files the business needs to a SharePoint site or a teammate's OneDrive.
Change any shared passwords they knew. Remove them from non-Microsoft apps.
Remove the license and reduce your license count if you won't rehire.
Delete the account only if you didn't create a shared mailbox or forwarding.

The clocks you need to know about

Event	What Microsoft says happens
You remove the license	The user's data is held for 30 days. After that, their content (except documents stored in SharePoint) is permanently deleted. Convert to a shared mailbox before this step if you want to keep them. (Step 6)
OneDrive stays unlicensed	Read-only after 60 unlicensed days, archived after 93. (Unlicensed OneDrive accounts)
You delete the user	The account can be restored for about 30 days. OneDrive is kept for 30 days by default, adjustable in the SharePoint admin center. (Step 7, OneDrive retention and deletion)

If you want copies that outlast these windows, that's what a backup is for. See Does a small business need Microsoft 365 backup?

Step 1: Cut off access

Microsoft's first step is to reset the password and sign the user out, then block sign-in (Step 1):

In the Microsoft 365 admin center, go to Users > Active users, select the person, and choose Reset password.
Select the user again and, on the Account tab, choose Sign out of all sessions.
Choose Block sign-in and save.

Timing matters. Microsoft says blocking can take up to 24 hours to take effect, which is why the password reset comes first. An access token is good for about an hour, so the person may stay signed in to an open page until it expires. In the Microsoft Entra admin center, Revoke sessions on the user's overview page blocks new sign-ins and revokes refresh tokens (Revoke user access in Microsoft Entra ID).

To shut off email immediately as well, open the Exchange admin center, go to Recipients > Mailboxes, select the mailbox, choose Manage email apps settings, and turn off every option (Outlook desktop, EWS, mobile, IMAP, POP, Outlook on the web).

While you're in Entra, also:

Remove any admin roles the person held. If they were an admin, also check that your break-glass accounts and Conditional Access policies don't depend on them.
On the user's Authentication methods page, review and remove their registered MFA methods, which Authentication administrators can manage there (Manage user authentication methods). That way an old phone can't be used if the account is ever re-enabled.
Remove them from groups that grant access to apps or shared mailboxes.

If they're leaving on bad terms, do Step 1 before the conversation, not after.

Step 2: Deal with devices

If you manage devices with Intune (see the Intune setup guide), pick the right action:

Retire for a personal phone or laptop. Microsoft says Retire removes company data, managed apps, and settings and unenrolls the device, while keeping personal data. (Retire devices) If the phone was never enrolled and only uses app protection, use a selective wipe instead: see Intune app protection for BYOD phones.
Wipe for a company-owned device you're getting back or that's lost. Wipe factory-resets the device and removes all personal and organizational data. (Wipe devices)

No Intune? For phones that only have email set up, Microsoft's offboarding guide uses the Exchange admin center: Recipients > Mailboxes, select the user, Manage mobile devices, then choose a wipe option (such as Account Only Remote Wipe Device) and Block access. (Step 3)

Step 3: Keep the mailbox (shared mailbox or forwarding)

For most small businesses, converting to a shared mailbox is the right call. All existing email and calendar items stay, teammates can open it, and Microsoft says it doesn't need a license as long as it's under 50 GB. (Step 4, About shared mailboxes)

Convert the mailbox before you remove the license. Microsoft says the mailbox needs a license to see the convert option, so if you already removed it, add it back first. Follow Microsoft's Convert a user mailbox to a shared mailbox steps.
Give the manager or replacement access to the shared mailbox.
Cancel the person's upcoming meetings, especially ones that booked rooms or equipment. Microsoft notes those resources stay booked until the meetings are canceled.

The alternative is forwarding (Users > Active users > the user > Mail > Manage email forwarding). Forwarding only sends new mail to someone else, and old mail isn't moved.

Licensing catches: a shared mailbox over 50 GB, one with an archive, or one on litigation hold needs an Exchange Online Plan 2 license, or Plan 1 plus Exchange Online Archiving (About shared mailboxes). And don't delete the user account afterwards. Microsoft says the account "anchors" the shared mailbox or forwarding.

Step 4: Save OneDrive files

OneDrive is where people quietly keep the only copy of the price list or the client folder. Microsoft gives you two ways in (Step 5):

From the Microsoft 365 admin center: Users > Active users > the user > OneDrive > Create link to files. Open the link and use Move to or Copy to to put files in a SharePoint library or your own OneDrive. Microsoft notes that only the latest version of a file is moved.
Automatic manager access: by default, when a user is deleted, their manager (as set in Entra ID) gets access to the OneDrive and an email about it. Set a secondary owner in the SharePoint admin center for users without a manager. (OneDrive retention and deletion)

Move business files to a SharePoint site rather than another person's OneDrive. Otherwise you'll be doing this again when that person leaves.

Step 5: Shared passwords and other apps

Microsoft 365 offboarding doesn't touch accounts outside Microsoft 365. Make a list:

Apps that sign in with Microsoft (Entra ID SSO): blocking sign-in in Step 1 cuts off new sign-ins. But Microsoft notes that apps issuing their own session cookies control those sessions, and Entra can't directly revoke them (Revoke user access). Remove the user inside important apps too.
Apps with separate logins: bank portals, payroll, social media, domain registrar, vendor portals. Remove the user, or change the password if it was a shared login.
Wi-Fi and door codes, if staff knew them.

Shared logins are where a business password manager earns its keep: you can see who had access to what and revoke it in one place. Examples include Keeper Business and NordPass Business. These are ordinary links. I haven't reviewed either product here. For what to check before you choose one, see Password manager for a Microsoft 365 small business.

Step 6: Licenses

Microsoft says to remove any holds first, then unassign the license under Users > Active users > the user > Licenses and apps. To stop paying for the seat, go to Billing > Your products, select the subscription, and choose Remove licenses. (Step 6)

If someone needs to search the mailbox later for legal reasons, a hold (Microsoft now recommends a Microsoft 365 retention policy) must be applied before the account is deleted. That turns it into an inactive mailbox. Microsoft's offboarding guide calls this the more complicated option, worth it if your plan includes archiving and legal hold and litigation is a possibility. Otherwise, export the mailbox to a .pst file. (Step 2, Inactive mailboxes)
If they had a Teams Phone (PSTN) number, removing the license releases it so you can reassign it. Microsoft also recommends removing them from groups tied to call queues, and setting up call forwarding if needed.
Whether you can reduce seats mid-term depends on your billing commitment. Check with Microsoft or your reseller before you count on the savings.

Step 7: Delete the account (or don't)

If you converted to a shared mailbox or set up forwarding, stop here. Don't delete the account. Otherwise, once files and email are saved, delete the user under Users > Active users > Delete user. Microsoft says the account stays restorable for about 30 days (Step 7, Restore a user).

Keep a simple offboarding log (date, who did each step, where files went). It takes five minutes and answers every "where did Sam's files go?" question later.

Sources

Related tools: a business password manager for shared logins (Step 5) and a Microsoft 365 backup if you need copies beyond 30 days (backup guide). These are ordinary links, not affiliate links.

Accuracy note: Microsoft changes admin center menus and licensing often. Paths and prices were checked against Microsoft documentation on 2026-10-22. If something has moved, tell me at [email protected].