How to Offboard a Departing Employee in Microsoft 365

Offboarding is one of those IT tasks that’s easy to do halfway — revoke the obvious stuff, forget a step, and leave a gap that surfaces months later as a security or compliance problem. Microsoft’s own documentation lays out a specific sequence for Microsoft 365 specifically, and it’s worth following closely rather than improvising.

Step One: Block Sign-In Immediately

The very first action, before anything else, is blocking the departing employee’s sign-in in the Microsoft 365 admin center — this should happen as close as possible to the moment their access needs to end, not at the end of a longer offboarding checklist. Blocking sign-in prevents new logins immediately, though it doesn’t terminate sessions already in progress on a device where they’re currently logged in.

Step Two: Revoke Active Sessions

Blocking sign-in alone doesn’t end an already-active session. Revoke existing sessions for the user as a separate, explicit step — this forces re-authentication everywhere, which fails immediately once sign-in is blocked, closing the gap left by step one.

Step Three: Reset the Password

Reset the account password even though sign-in is already blocked. It isn’t strictly required for the block itself to work, but skipping it means the employee’s actual password still technically exists and would work again if sign-in is ever accidentally re-enabled, or if the account needs to be reactivated briefly for data migration — leaving an unnecessary loose end.

Step Four: Convert the Mailbox to a Shared Mailbox — Before Removing the License

This is the step with the most common gotcha. To convert a user’s mailbox to a shared mailbox so a manager or team can retain access to their email history, the mailbox needs an active license at the time of conversion — in the Microsoft 365 admin center, go to Users > Active users, select the departing employee, open the Mail tab, and choose Convert to shared mailbox. If the license was already removed before this step, add it back temporarily, do the conversion, and then remove it again afterward.

The 50GB Shared Mailbox Limit

A converted shared mailbox is free to keep, with no license required to maintain it going forward, as long as it stays under 50GB. If the departing employee’s mailbox is larger than that, you have a few options: delete large messages and attachments to shrink it below the 50GB threshold before removing the license, keep an Exchange Online Plan 2 license assigned to the mailbox (which raises the limit to 100GB), or keep a Plan 1 license plus the Exchange Online Archiving add-on, which gives the mailbox an auto-expanding archive rather than a hard cap. Each of these has a real ongoing cost except the first — budget accordingly if the mailbox is large and historically important to retain in full.

Step Five: Forward Mail and Grant Access

Once converted, set the shared mailbox to forward incoming mail to a manager or team alias if ongoing correspondence needs a timely response, and grant the relevant manager or team members access so they can open and search the mailbox as needed — a converted shared mailbox on its own doesn’t automatically give anyone else visibility into it.

Step Six: Remove From Teams, Groups, and Distribution Lists

Separately from the mailbox work, go through Microsoft Teams, Microsoft 365 Groups, and any distribution lists the employee belonged to and remove them. This isn’t always automatic just because sign-in is blocked, and leaving stale group memberships in place is a common source of confusing bounced mail or permissions questions months later.

Step Seven: Transfer OneDrive and SharePoint File Ownership

Review what the departing employee owned in OneDrive and any SharePoint sites, and transfer ownership of business-critical files and sites to a current employee or manager before the account is fully disabled. Files owned solely by a disabled account can become harder to recover access to later if this step is skipped.

Step Eight: Remove MFA Methods and Document the Offboarding

Disable or remove the employee’s registered MFA methods so a stale authenticator app or phone number isn’t sitting active on a disabled account indefinitely, and keep a simple record of what was done and when — license removed, mailbox converted, group memberships cleared, file ownership transferred. This documentation matters for audits and for answering “did we actually finish offboarding this person” months later without having to reconstruct it from memory.

Offboarding an Admin or Global Admin Account

If the departing employee held Global Admin or any other privileged admin role, the stakes are higher and the checklist needs an extra layer. Before blocking their sign-in, confirm at least one other active Global Admin exists on the tenant — losing your only admin account along with the only person who knew the password is a genuinely difficult position to recover from. Review what other systems that admin role had access to beyond Microsoft 365 itself: a connected Azure subscription, a third-party app registered with elevated API permissions, a password manager’s admin console, or any integration that authenticated using that person’s credentials rather than a dedicated service account. Each of those needs its own access review and handoff, separate from the standard mailbox-and-license steps above.

What Happens to Scheduled Emails and Rules

A departing employee’s mailbox may have scheduled sends, inbox rules that auto-forward or auto-reply, or delegated calendar permissions that outlive the person who set them up. Once the mailbox is converted to shared, review and clean up any inbox rules that no longer make sense for a shared context — an old auto-reply or a rule forwarding specific senders to a personal external address is easy to miss and can quietly leak information or confuse customers if it’s left active after the handoff.

The License Timing Trade-off

There’s a real tension here worth naming directly: removing the license immediately saves money, but the mailbox conversion requires a license to be present at the moment of conversion, and losing the license before securing data access can complicate recovering files the employee owned. The safest sequence is block sign-in and reset the password immediately, then handle the mailbox conversion and file-ownership transfer promptly afterward, then remove the license once that work is confirmed complete — rather than removing the license as the very first action to save a prorated license fee.

Why This Deserves a Written Checklist, Not Memory

Because this spans several admin center screens and a specific ordering matters (license present for conversion, then removed), it’s worth keeping this as an actual written checklist your team follows every time, rather than relying on whoever handles offboarding to remember the right sequence under the time pressure of an actual departure.

Bottom Line

Block sign-in and reset the password first, convert the mailbox to shared before removing the license (watching the 50GB free-tier limit), then clear group memberships, transfer file ownership, and remove MFA methods — in roughly that order. Skipping the license-before-conversion step, or removing group memberships late, are the two most common gaps that surface as problems well after the employee is gone.