When someone leaves, their Microsoft 365 account does not leave with them. Their email still syncs to their phone, their browser is still signed in to OneDrive, and their Teams chats keep working until somebody turns it all off. Get the order wrong and you either leave the door open or delete a year of client email nobody else had a copy of.

TL;DR for managers. Block the account and kill every session the moment the person is gone. Save the mailbox and OneDrive before you delete anything. Give the mailbox and files to whoever takes over the work. Remove the license only after the data is handled. Deleting the account starts a 30-day clock, and after that the data is gone for good.

Before You Start

Decide two things first: who inherits the person's email and files, and whether anything has to be kept for legal reasons. If there is any chance of a dispute, talk to whoever handles your legal questions before deleting a single item. For a tense departure, do Steps 1 and 2 while the exit conversation is happening, not afterward.

You need an admin account in the Microsoft 365 admin center. Removing MFA methods takes at least the Authentication Administrator role in Microsoft Entra, and device actions need Intune permissions.

Step 1: Block Sign-In

In the Microsoft 365 admin center, go to Users, then Active users. Select the person, choose Block sign-in, check Block this user from signing in, and save. Blocking does not delete anything. The mailbox, OneDrive, and Teams history all stay exactly where they are, which is what you want for now.

Step 2: Reset the Password and Revoke Sessions

Blocking sign-in stops new logins, but devices that are already signed in can keep working on cached tokens. On the same user page, select Reset password, then go to the Account tab and select Sign out of all sessions.

Microsoft is upfront that this is not instant. An access token is good for an hour, so the person gets kicked out within an hour or as soon as they leave the page they are on. Outlook on the web in particular may stay open until they click to another app or refresh.

To cut them off right away, revoke their sessions from PowerShell. Revoke-MgUserSignInSession invalidates every refresh token issued to their apps and the session cookies in their browser, forcing a fresh sign-in everywhere, which now fails because the account is blocked.

Connect-MgGraph -Scopes "User.ReadWrite.All","User.RevokeSessions.All"

$upn = "jordan@contoso.com"
Update-MgUser -UserId $upn -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $upn

Step 3: Remove Their MFA Methods

The person's phone number and Authenticator app are still registered to the account. If the account ever gets re-enabled, even by accident, those methods are a way back in. Clear them.

In the Microsoft Entra admin center, go to Entra ID, then Users, select the person, and open Authentication methods. Select Require re-register MFA. Microsoft documents that this deletes their phone numbers, Microsoft Authenticator registrations, and software OATH tokens, and deactivates any hardware OATH tokens. The same screen has a Revoke sessions button if you skipped the PowerShell above.

Step 4: Wipe or Retire Their Devices

Company-owned laptops and phones get a Wipe. In Intune, the Wipe action factory resets the device, removing all personal and company data, apps, and settings. Use it for anything you are going to reissue to the next hire.

Personal phones get a Retire. Retire unenrolls the device from Intune and removes the managed apps, settings, profiles, and company data you deployed, while leaving the person's own photos and apps alone. That is the right call for a personal phone that had Outlook and Teams on it.

No Intune? Microsoft's own offboarding guide covers wiping and blocking a mobile device from the Exchange admin center, or through Basic Mobility and Security if you use it. Either way, collect the physical hardware too: laptop, keycard, and any hardware security keys.

Step 5: Convert the Mailbox to a Shared Mailbox

This is the move most small businesses want. Converting a user mailbox to a shared mailbox keeps every email and calendar item, lets the people who need it open it, and does not need a license as long as it stays under 50 GB. Forwarding alone only sends new mail onward, so the old messages would stay locked in a mailbox nobody can open.

Order matters here. The mailbox needs its license assigned when you convert it, or the option does not appear. In the admin center, go to Users, then Active users, select the person, open the Mail tab, and select Convert to shared mailbox. Then give the replacement access and set an automatic reply so outside senders know who to contact:

Set-Mailbox -Identity jordan@contoso.com -Type Shared
Add-MailboxPermission -Identity jordan@contoso.com -User casey@contoso.com -AccessRights FullAccess -InheritanceType All

Set-MailboxAutoReplyConfiguration -Identity jordan@contoso.com -AutoReplyState Enabled `
  -InternalMessage "Jordan has left the company. Please contact Casey." `
  -ExternalMessage "Jordan is no longer with us. Please email casey@contoso.com."

One warning straight from Microsoft: do not delete the user account after converting. The shared mailbox needs that account as its anchor. If you want the full rundown on how shared mailboxes behave, see our guide to shared mailbox access problems in OWA.

Step 6: Hand Off OneDrive Before the Clock Starts

OneDrive cleanup begins only when the account is deleted from Microsoft Entra ID. Blocking sign-in or removing the license does not start it. Once the account is deleted, the default OneDrive retention is 30 days, adjustable in the SharePoint admin center, and then the files are gone.

Do not wait for that window. In the admin center, select the person, open the OneDrive tab, and under Get access to files select Create link to files. Copy or move what matters into a shared library or the replacement's OneDrive. Note that moving files keeps only the latest version, not the history.

Microsoft also turns on automatic access delegation by default, so when a user is deleted their manager gets access to the OneDrive. That only works if the manager field is filled in, so check it, or set a secondary owner in the SharePoint admin center as a fallback. One more detail: an unlicensed OneDrive gets archived on its 93rd unlicensed day.

Step 7: Remove the License

With the mailbox converted and the files handed off, remove the license on the Licenses and apps tab. The license goes back into your pool for the next hire. You keep paying for it until you lower the license count on the subscription, so do that if nobody is replacing this seat.

Step 8: Clean Up Groups, Shared Access, and Admin Roles

Pull the person out of Microsoft 365 groups, Teams, distribution lists, and any shared mailboxes they had delegate access to. If they owned a team or group, assign a new owner first so nothing is left orphaned. Remove any admin roles. Check SharePoint and OneDrive for files they shared with people outside the company.

To see every group the account belongs to:

Get-MgUserMemberOf -UserId "jordan@contoso.com" -All |
  Select-Object @{n='Group'; e={ $_.AdditionalProperties.displayName }}

Step 9: Third-Party Apps and Shared Passwords

Apps that sign in through Microsoft 365 are cut off when the account is blocked. Everything with its own separate login is not: the accounting system, the CRM, vendor portals, the domain registrar, the company social media accounts. Walk through those one at a time and disable or transfer them.

Then change anything shared that the person knew: Wi-Fi passwords, alarm and door codes, and credentials in a shared password vault. After a bad departure, this step matters most.

Step 10: Delete the Account and Know the Restore Window

If you converted the mailbox to shared, keep the account. For everyone else, once the data is preserved, delete the user in the admin center. You then have 30 days to restore the account, and a restore within that window brings back the account and all associated data, including the mailbox. After 30 days it is permanent.

A Note for Seattle and Tacoma Small Businesses

A lot of small offices around Seattle, Tacoma, and the South Sound run Microsoft 365 without a full-time IT person, so offboarding lands on an office manager on someone's last day. Turn this list into your own written procedure with a name next to each step, and run it the same way every time. If you would rather hand it off, our Seattle IT support team handles onboarding and offboarding as part of day-to-day support.

References

Need a clean offboarding process for your Microsoft 365 tenant? Contact Rain City Techworks.