Staff Left? Keeping Their Microsoft 365 Mailbox and OneDrive

The order matters: what Microsoft recommends

Microsoft's guide to removing a former employee breaks the job into five steps. In practice, small businesses can follow this order on the last day:

1. 1

   Reset the password and sign out of all sessions

   In the Microsoft 365 admin centre, open the user, reset the password and choose Sign out of all sessions. Microsoft says access tokens last up to an hour, so sessions end within that time.

2. 2

   Block sign-in

   Select Block sign-in. Microsoft notes blocking can take up to 24 hours to take effect, which is why the password reset comes first.

3. 3

   Wipe or remove the account from their phone

   In the Exchange admin centre, use Account Only Remote Wipe for a personal phone, or a full wipe for a company device, then block it.

4. 4

   Convert the mailbox to shared, or forward it

   Keep the email and calendar in a shared mailbox that colleagues can open, and set an auto-reply with the new contact.

5. 5

   Hand over OneDrive files

   Give yourself or a manager access, then move what matters to a SharePoint library or the successor's OneDrive.

6. 6

   Remove the licence, then decide on deletion

   Once mail and files are safe, remove the licence to stop paying. Keep the account if it anchors a shared mailbox or forwarding.

Microsoft's step pages: block sign-in, forward or convert email and give access to OneDrive.

Keeping the mailbox: shared mailbox vs forwarding

Microsoft gives two options for a leaver's email. Most small businesses should convert to a shared mailbox.

Two rules from Microsoft's shared mailbox overview that people miss: sign-in for the shared mailbox's account should always stay blocked, and colleagues who open it need their own licensed mailbox. Microsoft also says not to delete the former employee's account while it anchors a shared mailbox or forwarding.

Saving their OneDrive before the clock runs out

OneDrive is where most files get lost, because people forget it exists until someone needs a contract. Microsoft's OneDrive retention and deletion page explains the defaults:

• When you delete the user, their OneDrive is kept for 30 days by default. Admins can change this to anything from 30 to 3,650 days in the SharePoint admin centre.
• The manager gets access automatically if one is set in Microsoft Entra ID, and receives an email, plus a reminder seven days before deletion. Set a secondary owner in case no manager is recorded.
• Blocking sign-in or removing the licence does not start this clock. Only deleting the user does.

The safer approach is not to rely on the retention window at all. In the admin centre, open the user, go to OneDrive, choose Create link to files, and move the folders that matter into a SharePoint library the team owns. Files in SharePoint belong to the organisation and do not disappear with a person.

Licence timing and unlicensed OneDrive accounts

Removing the licence is how you stop paying for a leaver. Microsoft's offboarding page says an unlicensed but undeleted account's OneDrive stays accessible after 30 days, but that is not the whole story. According to Microsoft's page on unlicensed OneDrive accounts, as of October 2026:

So "remove the licence and leave the account" is not a free archive. Move the files you need within the first few weeks. Our guide to Microsoft 365 licence optimisation covers finding and removing leavers' licences safely.

Holds, disputes and how long to keep a leaver's data

If there is a dispute, an HR investigation or any chance of legal action, preserve the data before you change anything. Microsoft's mailbox step describes two ways:

• Litigation hold, then delete: the mailbox becomes an inactive mailbox that admins can search with eDiscovery. This needs a plan that includes archiving and legal hold, and Microsoft calls it more complicated.
• Export to a PST file: simpler, but the file then needs to be stored securely, because it contains everything the person ever emailed.

A shared mailbox on litigation hold needs an Exchange Online Plan 2 licence or Plan 1 with Exchange Online Archiving. Outside a dispute, keep a leaver's mailbox only as long as there is a business need; old mailboxes full of customer and staff details are a PDPA risk if breached. A separate Microsoft 365 backup is the safety net if a step is missed.

Do it yourself or get help?

For one leaver, a confident admin can do this in under an hour. The common mistakes are deleting the user first, forgetting OneDrive, and leaving shared passwords unchanged.

The wider people-side list is in our employee offboarding IT checklist, and Google Workspace users should see our guide to transferring Google Workspace data when staff leave. If you would like leavers to be simple from now on, with SharePoint libraries, shared mailboxes and admin roles set up properly, our Microsoft 365 / Google Security Lockdown is S$590. For a backup that keeps leavers' mail and files beyond Microsoft's windows, see Backup & Ransomware Recovery (S$290).