What should you do with the Microsoft 365 account of an employee who leaves?

Why a forgotten account is a real risk

When someone leaves the company, people think of the badge, the keys and the laptop. The Microsoft 365 account, on the other hand, often stays open. Yet it has lost none of its power: it still opens the mailbox, the OneDrive files, the teams in Teams, the shared folders and sometimes business applications linked to the same sign-in.

Microsoft puts it plainly: in many organisations, user accounts aren't always deleted when employees leave, and these accounts that are no longer needed represent a security risk. The danger does not necessarily come from the former employee. It comes mainly from the fact that nobody looks at that account any more: if its password has leaked elsewhere, a suspicious sign-in goes unnoticed.

• The mailbox: it keeps receiving messages from customers and suppliers, including invoices and payment requests.
• The files: the person's OneDrive and everything shared with them in Teams or SharePoint.
• The phone: the Outlook or Teams app installed on their smartphone stays in sync until someone cuts it off.
• Access added along the way: an app password (a separate code, created so that an old email program or a printer can sign in without multi-factor authentication), a second phone for multi-factor authentication, an app allowed to read the mail.

Four common misconceptions

Most “forgotten” accounts aren't really forgotten: someone did take action, just not the right one. Here is what Microsoft's own pages say about the most common steps.

An invented example, for illustration. A saleswoman leaves a 15-person SME. To save a licence, her mailbox is turned into a shared mailbox that a colleague checks to keep up with customers. Nobody thinks about the password. Months later, that password, reused on a hacked website, is circulating online. Someone signs in to the shared mailbox and sends customers “new bank details”. Nobody was watching the account: it comes to light when a customer calls about a payment.

On the day they leave: the steps, in order

These steps are carried out by whoever manages your Microsoft 365, in-house or at your IT provider. They follow Microsoft's procedure for removing a former employee. The simplest approach is to time them for the last working day, at the time the person leaves.

1. Change the password and sign out of all sessions. This is the step that cuts off access fastest: the person is signed out within the hour, as soon as their current access expires.
2. Block sign-in. The account can no longer be used, even with the right password.
3. Cut off the phone. If the person read their work email on their smartphone, the administrator remotely wipes the work account only, without touching personal photos or apps, then blocks the device.
4. Remove what the person had added: their multi-factor authentication methods, their app passwords, the apps they had authorised and, above all, their admin rights if they had any.
5. Set up an automatic reply announcing the departure and giving a contact address (see below).
6. Keep what belongs to the company safe: move useful OneDrive files to a team folder, and save the emails a colleague needs to follow up a case.
7. Remove the licence, then delete the account once everything has been recovered. After deletion, Microsoft keeps the account for about 30 days, so it can still be restored if something was missed. Exception: if you turned their mailbox into a shared mailbox, do not delete the account, because the shared mailbox depends on it. Keep it blocked, with a new password.

Steps 1 to 4 are the most urgent: they are the ones that close the door. Steps 5 to 7 can be spread over a few weeks, provided the account is already blocked.

What about the mailbox? What the Data Protection Authority says

A former employee's mailbox contains personal data: theirs, and that of everyone who writes to them. So it cannot stay open indefinitely “just in case”.

In its decision 64/2020 of 29 September 2020 (in French), the Litigation Chamber of the Belgian Data Protection Authority (DPA) fined an SME 15,000 euros for leaving active, for two and a half to nearly three years, the email addresses of a former director who had left the company. The decision restates the following recommendation:

• Block the mailbox of the person who has left as soon as possible.
• Set up an automatic message telling correspondents that the person has left, for a reasonable period: in principle one month.
• Then delete the mailbox. An address in a former employee's name must no longer be used.

In practice, tell the person before they leave when their mailbox will be blocked, give them the chance to sort out their private messages, and write the rule once and for all into your IT policy. This is not legal advice: for a specific case, ask your lawyer or your payroll and HR provider.

OneDrive files: a quiet countdown

A former employee's OneDrive often holds working documents nobody else has: quotes, spreadsheets, contracts. What happens to them depends on the step chosen, and Microsoft's timelines are strict.

• Account deleted: their manager, if one is set in the employee's Microsoft 365 profile, gets access to the OneDrive for 30 days by default to recover the files. Otherwise, nobody gets it automatically: ask the administrator to grant that access before deleting the account. After that, the files go to the recycle bin, and sharing links sent to customers stop working.
• Licence removed without deleting the account: the OneDrive becomes read-only on day 60 and is archived on day 93. To reopen it, you have to assign a licence again or pay for reactivation.
• The right habit: before the person leaves, move useful documents to a team space (Teams or SharePoint), which does not depend on any one person.

Accounts already forgotten: a fifteen-minute check

If your company has seen people leave in recent years, there's a good chance an account is still lying around. Microsoft suggests spotting accounts by their last sign-in date and gives a window of 90 to 180 days without a sign-in as a reasonable benchmark. Ask your administrator to go through this:

1. Compare the list of Microsoft 365 accounts with the list of current staff. Every account must have an owner who is still with the company.
2. Find the accounts with no sign-in for more than 90 days and ask, for each one: who still needs it, and why?
3. Check the shared mailboxes that used to be personal mailboxes: sign-in must be blocked for the account.
4. Go through the list of administrators. No former employee or former provider should still be on it.
5. Clear out external guests (former consultants, former partners) who still have access to your teams in Teams.

Then turn the check into a habit: a leaver checklist shared between the person who handles staff and the person who handles IT, with the date and time the account is blocked. The account is closed on the day the person leaves, not when someone remembers.

Have your M365 accounts checked→