Published 16 June 2026 · Business IT · by the 365 Techies team — Microsoft Partners & Dell specialists, looking after Dorset since 1995
It is easy to handle a leaver’s keys and laptop and forget the part that matters more: the accounts. A former employee who can still read the company mailbox, or an attacker who takes over an account nobody is watching, is one of the most common ways a small firm gets hurt. This is the order we do it in.
On their last day
- Block sign-in. In the Microsoft 365 admin centre, block the user and reset their password; that alone stops new sign-ins. Then revoke their existing sessions from Microsoft Entra so an already-open Outlook or phone is signed out too, and remove the MFA methods registered to their personal phone.
- Take the devices back, or wipe them. Collect the laptop and phone. If a device is not coming back and it is managed with Intune, wipe it remotely; if it is not managed, at least remove the work account from it and change any saved passwords it held.
- Change what they knew. The Wi-Fi password, the shared inbox password, the alarm code, the banking and supplier logins that live on a sticky note. Anything shared is now theirs too.
In the first week
- Keep the mailbox without keeping the licence. Convert their mailbox to a shared mailbox before you remove the licence: it stays readable by whoever you choose, keeps receiving mail, and costs nothing while it is under 50 GB. Set an automatic reply telling senders who to contact now, and forward anything important to their successor.
- Save their files. Their OneDrive is kept for 30 days after the account is deleted and then removed. Give a manager access, move what the business needs into a shared SharePoint library, and download anything you are unsure about.
- Remove them everywhere else. Teams and groups, shared mailboxes, the accounts software (Xero, Sage, QuickBooks), the website and social media, the bank’s online portal, any supplier portals in their name. Reassign anything they owned: a Teams channel, a SharePoint site, a recurring meeting, a company phone number.
- Free the licence. Once the mailbox is shared and the files are moved, remove the Microsoft 365 licence so you stop paying for it, and reassign it to their replacement.
If they left on bad terms
Do the last-day steps before the conversation, not after it, and check their sent items and any inbox rules for forwarding to a personal address. If you suspect data has already gone, stop and take advice before deleting anything, because the account may be evidence.
If they were the only admin
That is the emergency version. A departing owner, director or IT-minded employee who was the only Global Administrator can leave the business unable to add users or recover anything. We have written up the handover when Microsoft 365 is in a leaver’s name and getting into a leaver’s locked computer, both of which we can do with you.
Key points
- Block sign-in, reset the password and revoke sessions on the last day
- Convert the mailbox to a shared mailbox before removing the licence
- OneDrive is kept 30 days after deletion: move what you need first
- Change every shared password and remove them from every other system
- Never leave the business with a single admin
Prefer to let us handle it? Our monthly IT support plans include this and much more, from £18.25/month per computer — with a friendly techie on hand whenever you need one. Call 01202 775566 or view our plans.