The operating principle
Licence removal is not the same as account deletion
Microsoft's guidance distinguishes blocking sign-in, mailbox access, OneDrive data handover, removing licences and eventually deleting the user. Exchange data can have a limited grace period after licence removal; retention and legal hold can change outcomes. Do not delete or unlicense first and ask about records later.
Security controls come first—but under an approved process
On an authorised departure, disable or block access, invalidate sessions where appropriate and assess active device, application and delegated access. The HR or business owner should approve the action and the timing; some departures need immediate access prevention while others use a planned handover.
Remember that the user may have app registrations, service accounts, shared mailboxes or external guest roles elsewhere. A checklist for the primary account is not proof that all access has ended.
| Decision | Owner to consult | Why it cannot be skipped |
|---|---|---|
| Block access and sessions | HR / authorised manager | Stop access at the agreed departure time |
| Preserve mailbox contents | Data / legal owner | Retain approved records and business correspondence |
| Reassign OneDrive access | Department owner | Prevent ownership and document loss |
| Handle forwarding/delegation | Mailbox owner / privacy lead | Avoid exposing private messages or breaking customers |
| Remove licence and account | IT + retention owner | Understand retention windows and dependent services |
Preserve business access without over-collecting employee data
Decide whether a shared mailbox conversion, delegation or export is justified by the company policy. Giving broad access to the entire mailbox may not be the right response to a request for one contract document.
For OneDrive, identify important repositories and give named owners appropriate access before deletion. Document customer-facing aliases, delegated calendars and automated mail flows that need to continue after departure.
Treat retention and billing as separate approvals
Microsoft describes how removing a licence affects Exchange data and how deleting a user affects OneDrive availability. The exact result depends on retention settings, subscriptions, hybrid directory configuration and any hold obligations.
Only when the necessary information is preserved and business processes transferred should the organisation approve removing paid entitlements and deleting the account. Record the decision, action time and verification.
Documented administration controls
- Departure time and authorising person
- Sign-in and session controls verified
- Business record and mailbox handover decision
- OneDrive and shared document ownership transferred
- Third-party applications, groups and guest access checked
- Licence and account deletion approved under policy
Preserve business continuity without creating a shadow archive
When someone leaves, the manager should identify outstanding business communications, group ownership, personal and team files, assigned devices and access to third-party applications. The administrator's job is to execute the approved access removal and handover, not decide what the employer may legally retain. An indefinite shared password or silent email forwarding rule is usually a poor substitute for an authorised mailbox and OneDrive preservation plan.
Work backwards from the leaver's final working day. Confirm emergency sign-in revocation, token/session invalidation where available, ownership transfer, group and application access changes, licence considerations and the procedure for recovering business materials. In hybrid estates, remember that directory synchronisation may make the on-premises directory the authority for some actions.
| Asset | Decision before access changes | Verification |
|---|---|---|
| Mailbox and business correspondence | Retention and authorised delegation | Manager accesses the approved location |
| OneDrive files | Business owner and preservation window | Representative critical document opens |
| SharePoint/Teams groups | Replacement ownership and membership | Owner can administer the space |
| External SaaS and app secrets | Inventory, revoke or rotate access | App owner checks sign-in and integration health |
Offboarding closure needs a second person
Have the request owner review the actions rather than relying on the same person who performed them to sign off. Record the termination instruction, effective date, ticket approvals, completed revocations, residual exceptions and when retained data will be revisited. This is particularly important for executives, privileged administrators and staff who own production automation.
Do not delete mailboxes or user accounts solely to save a licence before understanding recoverability and preservation. Different Microsoft 365 features and retention rules produce different outcomes; validate the client's actual policies and subscriptions before choosing a sequence.
Documented administration controls
- Business data owner approves handover and retention
- Sessions, privileged accounts and third-party apps assessed
- Mailbox, OneDrive, Teams and site ownership addressed
- Licence changes sequenced after preservation checks
- Closure evidence independently reviewed
A repeatable offboarding runbook protects both security and the information the business needs to keep.
Primary technical references
Check current feature and licence requirements before changing a tenant. A service description is not evidence that a customer has purchased or activated an option.
Commercial next step
Define a safer leaver workflow
Explain staff turnover, tenant size and the handover problems you're seeing. We can scope recurring onboarding and offboarding administration.
Request an administration assessment