Microsoft 365 staff leaver checklist: protect access, email and files

1. Agree the handover before changing the account

Give each departure a named manager, an IT contact and a confirmed access cutoff time. Include temporary staff, volunteers and contractors, not just permanent employees. Record who may authorise access to the person's information and when that access should end.

List the services they use: Microsoft 365, payroll, finance, school management systems, remote access, websites and supplier portals. Include any separate administrator account. A Microsoft 365 change does not necessarily remove an independent login elsewhere.

Decide what must remain available and to whom. Do not give a whole team unrestricted access to an entire mailbox simply because a handover is urgent. Involve the person responsible for information governance where confidential, safeguarding or personnel records are involved. If records must be preserved for an investigation or other formal purpose, agree that process before deletion.

2. Remove access without relying on one button

At the agreed time, an authorised administrator should follow Microsoft's leaver guidance to reset the password, sign the user out of sessions and block further sign in. Microsoft warns that blocking alone can take up to 24 hours, and existing sessions may not end immediately. Do not assume a successful checkbox means every application has already disconnected.

Coordinate changes to any local Active Directory account with your IT provider if accounts are synchronised to Microsoft 365. Review separate services and remote access too. Arrange the return of laptops, phones, keys and security tokens, and handle work data on personal devices through the organisation's approved process.

Do not hand the old password to the replacement employee. Give the replacement their own account and approved access so responsibilities remain clear. Record the actions and completion times, without putting passwords in the handover document.

Microsoft: prevent a former employee from accessing Microsoft 365

3. Decide what should happen to the mailbox

A shared mailbox can provide colleagues with the required email history. Microsoft requires a licensed user mailbox for conversion. Verify the conversion before considering licence removal.

Keep the underlying user account because it anchors the shared mailbox, but keep its direct sign in blocked. Conversion is not a substitute for removing the former employee's access. Give only approved colleagues access through their own accounts and review existing forwarding and inbox rules.

An unlicensed shared mailbox has a 50 GB limit. Larger mailboxes, archiving and hold requirements can require additional licensing. Ask the administrator to confirm the requirements first.

Agree who will handle enquiries and when to review the arrangement. Test receipt of a harmless message and access to the required history. Forwarding new messages alone does not transfer old email.

Microsoft: convert a user mailbox to a shared mailbox

4. Give OneDrive files a lasting home

Identify work that colleagues still need and move it to an appropriate, managed team location such as SharePoint, with suitable permissions. Test that the new owner can open the files and check important links and workflows. Keeping a shortcut to the departing person's OneDrive is not the same as completing the transfer.

Microsoft documents a default OneDrive retention period of 30 days after user deletion, which administrators can change. Retention policies and holds can alter the outcome. Check the actual settings and access delegation rather than assuming a manager will automatically receive a working handover.

Removing a licence is not a permanent file preservation strategy either. Microsoft's separate commercial unlicensed OneDrive rules include restricted access and archiving, normally at 60 and 93 unlicensed days respectively, with configuration and retention considerations. Microsoft says those policy changes do not apply to education customers. Schools should check their tenant status and storage arrangements, not copy a commercial timetable.

Microsoft: OneDrive retention and deletion

Microsoft: manage unlicensed OneDrive accounts and education exceptions

5. Check the dependencies that are easy to miss

Ask who owns important Teams spaces, shared documents, recurring meetings, forms, reports and automated tasks. A leaver may be the only person who knows how an important monthly job works. Assign a replacement owner and run a safe test where practical.

Review shared credentials the person knew and change them where necessary using your approved password management process. Check supplier contacts and recovery details so account recovery does not depend on a former employee's phone or personal address.

Licence removal and final deletion should follow a completed information and access review, not lead it. Where a shared mailbox still depends on the account, retain that blocked account. Set a review date so temporary access and forwarding do not become forgotten permanent arrangements.

6. A practical staff leaver checklist

Use this as a handover record with an owner and completion date for each item. Official Microsoft guidance and its revision dates were checked on 11 November 2026. There is no new universal leaver deadline: this is a useful routine to complete before a busy holiday period.

Bury I.T. Support Ltd can help businesses and schools review Microsoft 365 leaver procedures, mailbox access, file handovers and licensing. A consistent process makes the next departure easier to manage and gives the incoming member of staff a clearer start.

• Confirm the departure time, responsible manager and approved data access.
• List all accounts, devices and separate administrator access.
• Reset the password, sign out sessions and block sign in at the agreed time.
• Remove independent service access and arrange equipment return.
• Choose and test the mailbox arrangement before changing its licence.
• Keep any account required to anchor a shared mailbox, with sign in blocked.
• Transfer required files and test access, permissions and important links.
• Confirm retention, storage and any formal preservation requirements.
• Reassign important tasks, meetings and service ownership.
• Record completion and a review date for retained data and delegated access.