When an employee leaves, secure their sign-in, preserve the information the business must keep, and transfer responsibility for ongoing work before removing licenses or deleting the account. These are separate decisions. A disabled account can still hold essential records; a shared mailbox can still have an underlying account that needs to be secured.
This checklist helps an office manager coordinate an authorized Microsoft 365 administrator and the employee’s manager. It is designed for a planned departure. Suspected theft, an account compromise, a legal hold, or a disputed termination needs the responsible security, HR, or legal lead involved before routine cleanup.
Start with a departure record, not a delete button
Write down the employee’s exact account, the approved access cutoff time and timezone, the manager who authorized it, and the administrator carrying it out. Assign one person to accept the handover. “The team will handle it” leaves no one responsible for checking whether a customer can still reach the business.
Inventory the person’s mailbox, OneDrive, Teams and SharePoint responsibilities, devices, business applications, phone account, and physical access. Record which systems use Microsoft sign-in and which have separate credentials. Keep the checklist in a restricted location; it should reference secure records rather than contain passwords.
Before changing retention, ask the designated records owner whether any information must be preserved. Microsoft’s departure workflow separates access control, information preservation, handover, and account cleanup. The order matters because a billing action is not a records-management decision.
At the cutoff: close access and verify the result
The administrator should use the tenant’s approved procedure to reset the password, block sign-in, and revoke sessions. Use the appropriate administrative role for the account involved; an ordinary user and a privileged administrator can require different permissions. Microsoft documents these actions in its sign-in prevention instructions.
Do not treat a successful button click as proof that every session has ended. Microsoft warns that blocking sign-in can take time, and existing sessions may behave differently. Its access-revocation guidance also explains that an application can issue and control its own session token. The application owner may need to revoke access inside that application.
Record the actions and timestamps, review available sign-in evidence, and resolve any remaining access. Check VPN, remote-support, password-manager, phone, and vendor-portal accounts separately. Reassign business-owned automations or integrations before disabling an identity they depend on. Collect company equipment through the approved process; device actions must follow ownership and management policy.
Choose what should happen to incoming email
A manager should decide whether the address still needs to receive mail and who is allowed to see its contents. Forwarding new messages and giving access to historical mail solve different problems. Prefer an identified business recipient and a review date; open-ended forwarding can quietly become permanent access.
A shared mailbox may suit a role that a team will take over. Microsoft says to convert the licensed user mailbox before removing its license, and to retain the underlying account that anchors the shared mailbox. Conversion alone does not secure the former employee’s credentials. Check mailbox size, archive and hold requirements before changing licensing; the unlicensed shared-mailbox limit is 50 GB, and some features require licensing. See Microsoft’s conversion requirements.
Test the actual handover: send a routine test message, have the authorized recipient confirm delivery, and verify access to an agreed historical message or folder. Check delegated permissions and inbox rules. Document which behavior you tested rather than writing “email transferred.”
Move working files to an owned business location
Ask the manager which files are needed for current work, who should own them, and who should retain access. A suitable team SharePoint location may be more maintainable than moving everything into the next employee’s personal OneDrive. Have the file owner check the destination permissions and a few important links after the move.
Do not rely on a remembered “30-day rule.” Microsoft documents a default retention period for a deleted user’s OneDrive, but tenant settings and retention policies can change the outcome. Unlicensed accounts also have a separate archive process. Check the tenant’s actual configuration and Microsoft’s OneDrive retention and deletion guidance before setting a deadline.
Removing a license is not a promise of indefinite file access. Microsoft’s current unlicensed OneDrive guidance describes read-only, archive, and potential deletion stages. Record the applicable deadlines and assigned owner in the departure record instead of leaving the account as an undocumented storage solution.
A handover checklist with evidence
Use the following acceptance checks to close the work. “Approved” means approved by the person responsible for that decision, not merely completed by the administrator.
| Decision or task | Owner | Evidence to retain |
|---|---|---|
| Access cutoff | Manager and IT | Approved time; account; completed actions; unresolved sessions or apps |
| Record preservation | Records, HR or legal lead as applicable | Approved retention decision and any hold instructions |
| Email continuity | Business manager | Named recipient; test-message result; authorized historical access; review date |
| Files and shared work | New business owner | Destination; permission checks; important links tested; ownership accepted |
| Devices and other access | IT and facilities | Equipment disposition; separate apps, phone and door access checked |
| License and account cleanup | IT after owner approval | Dependencies checked; licensing decision; deletion decision or documented exception |
Example: a departing account manager
Illustrative example, not a TX Computing customer case: an account manager leaves on Friday. The sales manager needs incoming inquiries, while two colleagues need access to current proposals. The administrator secures the user at the agreed cutoff, implements the approved mailbox arrangement, and transfers the proposals to a team location with limited permissions.
The sales manager then confirms that a test inquiry arrives and that a colleague can open the active proposal from the normal work location. A recurring report owned by the departing user is reassigned and tested. License cleanup happens after those checks and the retention decision. This prevents a closed IT ticket from hiding an unfinished business handover.
When the checklist needs a different path
Hybrid environments need the administrator to identify the authoritative directory and follow the relevant on-premises and cloud procedures. A departure involving an administrator, shared credentials, sensitive records, or suspected compromise needs a wider access review. A shared mailbox should not be deleted simply because the person is gone; its account may still be required.
For help coordinating the account, mailbox, and device work, review TX Computing’s business email services and IT support and consultation. Bring the departure checklist and the systems inventory to the conversation. If you are reviewing the ongoing support arrangement, the managed service provider question guide helps turn offboarding responsibility into a written expectation.
Technical sources checked November 6, 2026. Microsoft’s interface, licensing, and retention behavior can change; verify the linked documentation and your tenant’s settings before taking action.
By mjunaid for TX Computing. Hero image is a generated conceptual illustration.