Offboarding goes wrong in two directions. Rush it and you delete a mailbox someone still needed, or orphan the files only that person had. Drag it out and a still-active account with a known password sits around for weeks after someone walked out unhappy. The fix is an order: cut off access immediately, preserve everything, hand off what others need, and only then tear down.
Step 1: Cut off access, now
Do these the moment the departure is confirmed, before anything else. Access revocation is urgent; data cleanup can wait a day.
- Block sign-in. In the Entra admin center, set the account to Block sign-in. This stops new authentications but does not kill existing tokens.
- Revoke active sessions. That is the step people skip. A refresh token can keep Outlook and Teams working for up to an hour after you block sign-in. Revoke it so the block takes effect immediately.
- Reset the password to something random, so a cached credential or password manager can't be reused.
Connect-MgGraph -Scopes "User.ReadWrite.All"
$upn = "jsmith@contoso.com"
# Block sign-in
Update-MgUser -UserId $upn -AccountEnabled:$false
# Revoke all refresh tokens / active sessions
Revoke-MgUserSignInSession -UserId $upnStep 2: Preserve before you delete
Once access is cut, nothing else is time-critical. Put a hold on the data before you touch the license, because removing the license starts a 30-day clock on the mailbox and OneDrive.
- Litigation hold or retention policy on the mailbox, if you have Business Premium or any plan with Exchange hold. This keeps content even after the mailbox is converted or removed.
- Note the OneDrive URL before the account is deleted. After deletion, OneDrive is retained for the configured period (default 30 days) and then purged.
Step 3: Handle the mailbox
Pick one based on who still needs the mail:
| Situation | Do this |
|---|---|
| A colleague needs ongoing access to the inbox | Convert to a shared mailbox and grant them access. A shared mailbox under 50 GB needs no license. |
| Mail should route elsewhere going forward | Set up forwarding or a transport rule to the manager or team. |
| Nobody needs it, but you must retain it | Leave it on hold, or export to PST, before removing the license. |
Connect-ExchangeOnline
# Convert to shared, then grant the manager full access
Set-Mailbox -Identity $upn -Type Shared
Add-MailboxPermission -Identity $upn -User manager@contoso.com -AccessRights FullAccess -InheritanceType AllStep 4: Reassign files and shared access
- OneDrive: grant the manager access to the departed user's OneDrive (via the user's profile in the M365 admin center, or by setting them as site admin), then have them move anything worth keeping into a shared location. OneDrive is the single biggest source of lost work after an offboarding.
- SharePoint and Teams: check for sites or teams the person solely owned. Add a new owner before the account is removed, or you get orphaned sites.
- Shared mailboxes, calendars, and distribution groups: remove them as a member or owner, and replace them where they were the only owner.
- App and service ownerships: enterprise app owners, Entra group owners, and any Power Platform or Azure resources they held.
Step 5: Devices and authentication methods
- Intune: for a company-owned device, issue a Wipe or Retire. For BYOD, Retire to remove company data only.
- Remove registered MFA methods so a leftover Authenticator registration can't be used if the account is ever re-enabled.
- Disable, don't delete, Autopilot device records you plan to re-deploy.
Step 6: Reclaim the license, then clean up
Only now. Removing the license frees the seat; if the mailbox is on hold or converted to shared, the content survives. Then:
- Remove assigned licenses (or let group-based licensing handle it when you remove group membership).
- Leave the account disabled, not deleted, for a retention window. Most of my clients keep it 30–90 days in case something was missed.
- After the window, delete the account. It sits in the Entra recycle bin for 30 more days if you need to recover it.
Frequently asked questions
What's the first thing to do when offboarding a user in Microsoft 365?
Block sign-in and revoke the user's active sessions. Blocking sign-in alone leaves existing refresh tokens valid for up to an hour; revoking the sessions makes the cutoff immediate. Reset the password too, so a cached credential can't be reused.
Can I delete the mailbox of an employee who left?
Not before you decide who still needs the mail. Convert it to a shared mailbox (free under 50 GB) or set up forwarding, and put it on hold, before you remove the license — removing the license starts a 30-day deletion clock on the mailbox and OneDrive.
What happens to a departed user's OneDrive files?
Grant the manager access and move anything worth keeping into a shared location first. After the account is deleted, OneDrive is retained for the configured period (default 30 days) and then permanently purged, so capture it before then.