How do I remove a leaver's access in Microsoft 365?

Block sign-in on their Microsoft Entra ID account, revoke their active sessions, reset their password, and remove them from groups and app access. Then deal with their mailbox, OneDrive files and licence. Doing it in that order closes access first and tidies up after.

Should I delete the account straight away?

Usually not. Block sign-in first, then keep the account long enough to hand over email and files. Deleted users can be restored for 30 days, and after that the account and its OneDrive may be gone. Agree a retention period with HR and IT.

What happens to their email?

A common approach is to convert the mailbox to a shared mailbox and give the manager access, or set up forwarding and an auto-reply. Shared mailboxes under 50 GB don't need a licence, so you can then remove the user's licence.

What happens to their OneDrive files?

When a user is deleted, Microsoft 365 can give their manager access to the OneDrive for a set period. Move anything the business needs to a SharePoint site or Teams channel before that period ends.

Can offboarding be automated?

Yes. One offboarding request in SharePoint or Power Apps can start a Power Automate flow that notifies IT, payroll and the manager, and tracks each task. Account steps like blocking sign-in can be automated too, scoped to what your IT team approves.

Home / Guides / Employee offboarding in Microsoft 365

Guide

How to offboard an employee in Microsoft 365

Short answer: on the person's last day, block sign-in and revoke their sessions in Microsoft Entra ID. Then hand their mailbox and OneDrive files to their manager, remove their licence, recover equipment and close out payroll. A single offboarding request that sends every task to the right team makes sure nothing is missed, and leaves a record of who did what.

By 365 Easy · Updated November 2026

Why offboarding matters more than onboarding

A slow onboarding costs a few days of a new hire's time. A missed offboarding step can leave a former employee with access to email, files and customer data. It also leaves you paying for a licence nobody uses. Offboarding is usually the less polished process, so it's often where the gaps are.

Offboarding checklist for Microsoft 365

1. Start with one request

HR or the manager submits a single offboarding request with the person, last day and manager. Use a SharePoint list or Power Apps form, so every team works from the same record, not from email.

2. Close access on the last day

In Microsoft Entra ID, block sign-in, revoke sign-in sessions and reset the password. Remove the person from groups, Teams and shared sites, and from any apps that sign in with their Microsoft account. If you use Intune, retire or wipe company devices and remove company data from personal phones.

3. Hand over email

Convert the mailbox to a shared mailbox and give the manager access, or set forwarding and an auto-reply so customers aren't left waiting. Update any distribution lists and shared calendars they owned.

4. Hand over files

Ask the manager to review the person's OneDrive and move anything the business needs to a SharePoint site or Teams channel. Check for files and sites the person owned, and assign a new owner.

5. Remove the licence

Once email and files are handled, remove the licence so you stop paying for it. With group-based licensing, removing the person from the right groups does this for you.

6. Recover equipment and close out payroll

Track the laptop, phone, keys and access cards as tasks, along with final pay, benefits and exit paperwork. Each team marks its own tasks done.

7. Keep the record

Log who approved the exit, when access was removed and when each task was done. If a customer, auditor or insurer asks, you can show it.

Common mistakes

Deleting the account first, and losing email and files the business still needs
Blocking the password but not revoking active sessions on phones and browsers
Forgetting apps outside Microsoft 365 that the person signed in to
Paying for licences on accounts nobody uses
No record of when access was actually removed

Do it by hand, or make it one process

A checklist works when you have one or two leavers a year. Beyond that, a tracked process saves time and closes gaps. 365People is our ready-made app for onboarding, role changes and offboarding. One request sends the right tasks to IT, payroll and the manager, inside your own Microsoft 365. For the joining side, read our guide on how to automate employee onboarding in Microsoft 365.

Get a free process audit