Microsoft 365 / Offboarding: block access and hand over email and OneDrive

In Microsoft 365 employee offboarding, access should be blocked first, then email and OneDrive data handover should be verified, and finally decisions regarding license and account deletion should be made. If the license is removed first or the account is deleted immediately, it may become difficult to access necessary data. Make sure to review the organization's retention, legal requirements, and human resources (HR) procedures together.

Decisions to make before offboarding

Record the timing of access blocking, the person responsible for handover, emails/files/Teams materials that need to be retained, handling method for personal and company devices, and the planned account deletion date. If there are legal retention obligations or the employee is subject to investigation, consult with legal/security personnel before proceeding with standard deletion procedures. In a hybrid identity environment, which connects on-premises and cloud identities, also check the on-premises account and synchronization status.

Microsoft classifies offboarding procedures into access blocking, data retention, device handling, handover, and account deletion. The methods available may vary depending on organizational policies and licenses.

Do not select the work target based only on the display name; identify them using the full login address and affiliated organization.

In the task list, create separate items for “Access Blocking,” “Data Handover,” “Owner Replacement,” and “Product/Account Handling.” Even if the IT administrator has completed blocking, the overall offboarding is not complete if the department has not verified the data. Also, check if the user is the sole owner of any shared teams, groups, or apps, and prepare a replacement owner.

Start by blocking access

1. In the Microsoft 365 admin center, open Users → Active users and verify the full sign-in address and tenant before selecting the account. Use an administrator authorized to manage that target; permissions to reset passwords or end sessions for ordinary users do not automatically cover privileged administrators.
2. Block the target user's login and reset the password. Also, consider measures to invalidate existing login sessions. Do not assume that simply changing the password will immediately terminate the existing sessions.
3. Check the administrator role, groups, app access, external service integration, and device registration, and remove or revoke them as needed. When removing company data from a mobile device, first check its impact on personal data.

In the selected user’s details, choose Block sign-in → Block this user from signing in → Save changes. Reset the password and use Account → Sign out of all sessions as separate actions. Microsoft’s access-blocking and session sign-out procedure notes that account blocking can take up to 24 hours to take effect and that existing tokens or the current service session can delay sign-out. Do not interpret a saved setting as proof that every app has immediately stopped. For urgent containment, have security staff assess additional service-specific restrictions.

Verify the saved account state and relevant sign-in records. Do not obtain the former employee’s credentials or impersonate them to check the result. Signing in with an unrelated test account does not establish that the departing employee has been blocked; assess that account’s status and the actions taken on its sessions.

How do I transfer mail and OneDrive?

If business continuity is needed, start by deciding the handover method of the email mailbox. Converting to a shared mailbox, granting access to other employees, exporting necessary emails, etc., may each have different license and retention requirements. Automatic forwarding carries risks of personal information and external leakage, so the recipients and duration must be approved. Check the current support procedures in Microsoft’s Email and OneDrive Data Handover Guide .

To keep the mailbox in use, start with a licensed user mailbox and open Users → Active users → the user → Mail → Convert to shared mailbox → Convert. Verify the resulting mailbox type before considering license removal. Removing the license first can hide the conversion option. Microsoft’s mailbox conversion guide states that an unlicensed shared mailbox is limited to 50 GB; larger mailboxes, archiving and hold features can require additional licensing. Check those requirements rather than treating conversion as automatic permission to remove every license.

The base user account of a shared mailbox must not be deleted. Even if the user has left, the connected account is needed while maintaining the shared mailbox. Direct login should remain blocked, and grant the successor read and send delegation permissions so they can access it using their own account. Review the inbox rules and forwarding settings as they may remain, to ensure it is in the intended state.

For OneDrive, agree on the receiving owner, the necessary files and the access period. For long-term business use, moving the required material to an appropriate SharePoint team site can be preferable to giving another employee indefinite access to an entire personal work storage area. Check existing links and recipients after the transfer.

Order for checking and transferring OneDrive files

1. An approved administrator opens Users → Active users → the user → OneDrive → Get access to files → Create link to files. Use this supported administrative route, not the employee’s password. Confirm that the account and content are in a state that supports access; archived or otherwise restricted unlicensed content can require supported licensing or reactivation first.
2. Decide on the list of necessary folders and files, final storage location, and retention requirements with the person in charge of the work. Rather than making the entire personal workspace indefinitely public, define the necessary scope and responsible persons.
3. Use a supported move or copy method to transfer the required files to the approved destination, such as a team site. Do not assume that a copy or download includes version history. The offboarding guide warns about latest-version-only transfers; if earlier versions must be retained, validate the chosen method and the destination history before removing the original. Check links and permissions as well.
4. Open important documents with the successor's account and check whether content, permissions, and required history exist. Do not judge the transfer as complete simply because the number of files matches.
5. Remove temporary administrative access when it is no longer needed and record the change. The handover guide provides a SharePoint Administrator route through SharePoint admin center → More features → User profiles → Open → Manage User Profiles → the former user → Manage site collection owners. Remove the unnecessary administrator from the site collection administrators list and verify the saved result; preserve any access still required by an approved owner.

If the account or OneDrive has already been deleted, the active-user route no longer applies. Follow Microsoft’s deleted OneDrive restoration guide to determine whether recovery is possible. Deleted-user OneDrive retention is configurable and defaults to 30 days, followed by a separate 93-day deleted-site period during which a SharePoint Administrator can restore it. Do not confuse these periods with an individual file’s recycle bin. The Microsoft 365 admin center’s active-user OneDrive tab options are not supported for Multi-Geo tenants; use the documented route appropriate to the tenant.

Checks before license removal and account deletion

• Confirm that email, OneDrive, Teams, etc., have been handed over and that the person in charge can access the materials.
• Check license requirements necessary for shared mailbox conversion or retention policies. Not all shared mailboxes are always operated without a license.
• Review audit/legal retention, recovery period, and internal record-keeping rules.
• Then, get approval for the timing of license removal and account deletion, execute it, and keep a record of completion.

Is it safe to leave the account while only removing the license?

An unlicensed OneDrive is not an indefinitely free archive. For customers covered by Microsoft’s current unlicensed-account policy, the default lifecycle places the account in read-only mode after 60 unlicensed days and archives it, or processes it according to the account and retention state, after 93 days. Applicable licensing, billing and reactivation requirements can affect access. These policy changes do not apply to education customers, Government Community Cloud customers or U.S. Department of Defense customers. An organization’s configured active-storage period can also change the default timing; see Microsoft’s Standard storage controls for unlicensed OneDrive accounts.

Since July 1, 2026, covered unlicensed OneDrive accounts that remain unpaid are subject to a cumulative 365-day nonpayment clock. For accounts already unlicensed and unpaid on that date, deletion risk begins no earlier than July 1, 2027; later cases depend on when their cumulative unpaid period reaches 365 days. Keeping the user account alone is not a preservation plan. Check Microsoft’s unlicensed OneDrive account management guide and SharePoint admin center → Reports → OneDrive Accounts for status, retention and billing conditions. Have the compliance owner approve a suitable licensing, storage and archiving approach when data must be preserved.

The recoverable period after deletion and data retention behavior vary depending on the service and settings. The final record includes block status, session actions, data handover verifier, whether to retain the account due to shared mailboxes, revoked licenses, remaining admin/app/device permissions, and the next review date. If the wrong target was processed, stop additional changes, check the current status and affected services, and then proceed with approved recovery procedures.