Offboarding

When someone leaves, their access should leave the same day.

Leavers' accounts that stay open, shared passwords nobody changed and laptops that never came back are some of the easiest ways into a business. Here is what to do before the last day, on the day and after, what Microsoft 365 does with their mailbox and files, and a checklist builder you can copy into your ticket.

Microsoft 365 retention rules from Microsoft Learn, checked 30 October 2026.

Have us run offboarding Build a checklist 07 3114 2808

Before, on the day, after
Mailbox and OneDrive rules
Checklist builder

Reviewed by Blake Bath, General Manager, on 30 October 2026.

An office manager ticks off a printed checklist beside a returned laptop with its charger, a phone and an access card in a tray. — **Block, do not delete**Block sign-in and revoke sessions on the day. Delete later, once mail and files are dealt with.

What gets missed

Five things that get missed when people leave.

Each of these leaves a door open after the person has gone.

Accounts left enabled

The account stays active for weeks because nobody owned the task.

Same-day block
Sessions revoked
One owner

Offboarding checklist builder

Build the offboarding checklist for this leaver.

Answer five questions. You get the steps in order for before, during and after, ready to copy into a ticket.

Answer five questions for an offboarding checklist in the right order. Copy it into your ticket or HR file.

What kind of exit?

Which devices do they use for work?

Do they have admin access?

Do they touch banking or payroll?

What should happen to their mailbox?

Your checklist

15steps, in order

Before

Agree the last day and handover with HR and the manager.
List every account, shared mailbox, Teams team, SharePoint site and app the person uses or owns.
Move ownership of Teams, groups and SharePoint sites to someone staying.
Arrange laptop and phone return, with a courier label if they work remotely.

On the last day

End of the last day: block sign-in and revoke all sessions.
Remove their MFA methods and passkeys, and reset the password.
Check for and remove mail forwarding and inbox rules.
Disable VPN, remote access and any app that does not use your Microsoft or Google sign-in.
Change shared passwords they knew: Wi-Fi, social media, supplier portals.
Collect the laptop, phone, security keys, access card and company card.

After

Convert the mailbox to a shared mailbox. Under 50 GB, it needs no licence.
Move important OneDrive files to the manager. Microsoft keeps a deleted user's OneDrive for 30 days by default.
Wipe and reset the laptop before it goes to the next person.
Reclaim the licence once mailbox and files are dealt with.
Record what was done and when, for your audit trail.

Have us run offboarding

What Microsoft does

What happens to a leaver's data in Microsoft 365.

What	What happens	What to do
Deleted user account	Can be restored for 30 days	Block sign-in first. Delete later.
OneDrive	Kept 30 days by default after the user is deleted, with access for their manager	Move important files. Extend retention in SharePoint settings if needed (30 to 3,650 days).
Unlicensed OneDrive	Archived on its 93rd day without a licence	Do not leave accounts unlicensed indefinitely.
Mailbox	Goes with the account unless kept	Convert to shared (no licence under 50 GB) or place on hold.

Retention policies and holds override these defaults. Check what your tenant has set before relying on them.

When it is not friendly

Terminations: timing is everything.

Brief IT ahead, in confidenceSo disables are ready the moment HR starts.
Disable as the meeting startsSign-in blocked, sessions revoked, MFA removed, at the same time.
Collect devices in the roomLaptop, phone, keys and cards, not requested later.
Cancel building access togetherPhysical and digital access go at the same moment.
Watch for sign-in attemptsAlert on any attempt to use the account afterwards.
Review the last few weeksNew mail rules, large downloads, files shared outside or USB copies.

Our view

Make offboarding a ticket, not a memory.

Treat offboarding as a standard ticket that HR raises the moment a resignation lands, with the same checklist every time, rather than relying on someone remembering.

Two things make the biggest difference: a password manager, so you know exactly which shared logins the person could see, and an app register, so the systems outside Microsoft or Google sign-in do not get missed.

The order

Offboarding in six steps.

Step 1Plan
Last day, handover, and every account and device listed.
Step 2Hand over ownership
Teams, groups, sites and shared mailboxes moved.
Step 3Cut access
Block, revoke sessions, remove MFA and admin roles.
Step 4Secure the rest
Non-SSO apps, shared passwords, banking access.
Step 5Keep the data
Mailbox to shared or hold, OneDrive files moved.
Step 6Record it
What was done, when, and by whom.

Related guides

Leaving is one end. Starting is the other.

Joiners, devices and passwords that make leaving easier.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about offboarding.

What should IT do when an employee leaves?

On the last day, block their sign-in and revoke every session, remove their MFA methods, check for mail forwarding rules, remove admin roles, and collect devices. Then deal with their mailbox and OneDrive, change any shared passwords they knew, and record what was done.

Should we delete the account straight away?

No. Block sign-in first. Deleting the account starts Microsoft's clocks: the user can be restored for 30 days and their OneDrive is kept for 30 days by default. Decide what happens to the mailbox and files before you delete anything.

What happens to a leaver's OneDrive?

When you delete the user, their manager gets access to the OneDrive and an email saying when it will be deleted. The default is 30 days, and you can set it anywhere from 30 days to 10 years. Unlicensed OneDrive accounts are archived on their 93rd day without a licence.

Can we keep their mailbox without paying for a licence?

Yes, by converting it to a shared mailbox, as long as it stays under 50 GB and does not need an archive or a hold. Mailboxes that need a hold or are larger need a licence.

What is different when someone is terminated?

Timing. IT disables everything as the meeting starts, not after, devices are collected in the room, building access is cancelled at the same moment, and someone reviews the account's recent activity for downloads or new mail rules.

Next step