Microsoft 365 Leavers: Access and Data Handover

A leaver process has two immediate responsibilities: stop the departing person’s access and preserve the business’s ability to continue its work. Deleting the account first can make the second responsibility harder.

Agree the departure time, data owner and handover decision before making changes. Keep urgent access removal moving even when the longer-term data decision is still being completed.

Record separate decisions

Microsoft’s leaver guidance covers sign-in prevention, mailbox handling, device actions, OneDrive access and eventual account removal. Use separate completion evidence for each part.

Do not interpret “give the manager access” as unlimited permission to copy everything into another employee’s personal workspace. Define the business scope and destination.

Identify any automated process or shared resource that still depends on the departing account. Give each dependency a service owner and a replacement plan.

Prevent access independently of mailbox conversion

Use the approved sign-in and session-containment procedure at the agreed time. Handle synchronised identities through the relevant source system.

Converting a mailbox to shared does not itself prove that the former employee can no longer authenticate. Microsoft’s conversion guidance explicitly calls for additional leaver controls.

Record the access-removal result separately from the mailbox’s new type. If the departure involves suspected compromise, keep incident containment and evidence preservation under the incident owner.

Make the mailbox choice deliberately

A shared mailbox can preserve email and calendar information for authorised colleagues. Before conversion, check the mailbox’s licence and the features it uses.

Microsoft says the user mailbox needs a licence for conversion. An unlicensed shared mailbox has a 50 GB limit, and features such as holds or additional capacity can require licensing. Confirm the actual requirement before removing a licence.

Keep the associated user account: it anchors the shared mailbox. A later cleanup job must not delete it simply because it belongs to a former employee.

Review who can access the mailbox, whether they need sending permission and what should happen to new mail. Check inbox rules and forwarding as part of the mail-flow audit. Record a review date for the continuing mailbox rather than leaving it ownerless.

Transfer OneDrive work to an appropriate owner

Microsoft documents ways to grant access to a former user’s files. Use that access to identify and transfer the agreed business material.

For continuing team work, choose a managed shared location with a current owner. Give the recipient enough information to understand the folder structure, important links and any recurring process that consumes the files.

Test the transferred result. Open representative documents as the successor, check access for someone who should be excluded, and inspect any required version history or metadata. Copying a collection of filenames is not proof that all useful context moved with it.

Remove temporary administrative or successor access to the former OneDrive when the handover no longer needs it.

Check the actual OneDrive lifecycle

The OneDrive retention documentation distinguishes account deletion from removing a licence or blocking sign-in. The deleted-user retention period is configurable, and retention policies or holds can affect the outcome.

Unlicensed OneDrive accounts also have a separate archive lifecycle. Keeping the account object does not justify assuming that the files will remain conveniently accessible forever.

Inspect the tenant’s configured dates, notifications and applicable retention requirements. Confirm that the manager or secondary owner is set correctly before relying on automatic delegation.

The existing retention and auto-archive guide covers the wider storage-policy context. The leaver record needs the concrete decision for this account.

Close when the successor can work

Have the successor demonstrate the agreed task using their own account. Confirm the former employee’s access is blocked, the mailbox has an owner, the files have a suitable home and temporary grants have an end date.

Schedule any eventual account deletion only after checking that it will not remove a required mailbox anchor or interrupt an unfinished handover. Keep the evidence concise enough for the next administrator to understand why each remaining object still exists.

References

• Microsoft — Remove a former employee from Microsoft 365. Accessed 17 October 2026.
• Microsoft — Convert a user mailbox to a shared mailbox. Accessed 17 October 2026.
• Microsoft — Give another employee access to OneDrive and Outlook data. Accessed 17 October 2026.
• Microsoft — OneDrive retention and deletion. Accessed 17 October 2026.