A question we often get is, "What should I do to secure data and protect access when an employee leaves my organization?" This article series explains how to block access to Microsoft 365 so these users can't sign in to Microsoft 365, the steps you should take to secure organization data, and how to allow other employees to access email and OneDrive data.
Before you begin
To complete the steps in this series, you use these Microsoft 365 capabilities and features.
Product or component
Capability or feature
Microsoft 365 admin center
Convert mailbox, forward email, revoke access, remove user
Exchange admin center
Block user, block access to email, wipe device
OneDrive and SharePoint
Give access to other users
Outlook
Import pst files, add mailbox
Active Directory
Remove users in hybrid environments
Solution: Remove a former employee
Important
Although we've numbered the steps in this solution and you don't have to complete the solution using the exact order, we do recommend doing the steps this way.
This lets you keep the former employee's email address active. If you have customers or partners still sending email to the former employee's address, this gets them to the person taking over the work.
If you only remove a user's license but don't delete the account, the content in the user's OneDrive will remain accessible to you even after 30 days.
Before you delete the account, you should give access of their OneDrive and Outlook to another user. After you delete an employee's account, the content in their OneDrive and Outlook is retained for 30 days. During that 30 days, however, you can restore the user's account, and gain access to their content. If you restore the user's account, the OneDrive and Outlook content will remain accessible to you even after 30 days.
When you remove a license, you can assign it to someone else. Or, you can delete the license so you don't pay for it until you hire another person.
When you remove or delete a license, the user's old email, contacts, and calendar are retained for 30 days, then permanently deleted. If you remove or delete a license but don't delete the account, the content in the user's OneDrive will remain accessible to you even after 30 days.
If your organization synchronizes user accounts to Microsoft 365 from a local Active Directory environment, you must delete and restore those user accounts in your local Active Directory service. You can't delete or restore them in Microsoft 365.
To learn how to delete and restore user account in Active Directory, see Delete a User Account.
If you're using Microsoft Entra ID, see the Remove-MgUser PowerShell cmdlet.
This module provides instruction on how to create and manage user accounts, assign Microsoft 365 licenses to users, recover deleted user accounts, and create and manage guests and contacts.
