Someone leaves your company, whether they quit or were let go, and HR closes the file. Payroll stops. Keys get returned. But their Microsoft 365 account often stays open for days or weeks because nobody is sure who owns that task. logic-IT hears this question most weeks, and the answer is the same: yes, you need to act on it, and the sooner the better.
Why an Open Account Is a Real Risk
A former employee’s Microsoft 365 account gives them a working login to your email, SharePoint, Teams, and any connected apps. If they left on bad terms, that access is a liability. If they left on good terms, it is still a credential that no longer belongs to anyone who works for you, which means it sits outside your normal security habits. Disabling the account in Microsoft 365 Admin Center is the first move, and it takes about two minutes, but it is not the end of the checklist.
The Steps Most Small Businesses Miss
Disabling a login does not automatically preserve the mailbox, reassign shared resources, or protect files the employee stored in OneDrive. Before you close the ticket, work through these items:
- Preserve or redirect the mailbox. Microsoft 365 keeps a disabled mailbox active for 30 days before it moves to an inactive state. During that window, a manager or admin should decide whether to convert it to a shared mailbox so the team can still access old emails, or set up a forwarding rule so incoming messages reach the right person.
- Reassign shared mailboxes and distribution lists. If the former employee held delegate access on a shared mailbox, remove that delegation. If they were the primary contact on a distribution list, update the list owner so replies go somewhere useful.
- Transfer OneDrive files. Files stored in a departing employee’s OneDrive belong to their account. An admin can give another user access to that OneDrive for a set period, typically 30 days by default in Microsoft 365, to copy or move anything the business needs. Miss that window and recovery gets complicated.
- Revoke app permissions and MFA devices. Check which third-party apps the account authorized and remove those connections. Also remove any registered authenticator devices so the old phone cannot approve a sign-in.
- Review license assignment. Once the account is fully offboarded, unassign the Microsoft 365 license. You stop paying for it, and it becomes available for a future hire.
Setting Up New Hires the Right Way
Offboarding and onboarding share the same underlying problem: access gets set up too broadly because it is faster in the moment. When you add a new employee, resist copying permissions from an existing account without reviewing what that account holds. A customer service rep does not need access to your finance SharePoint folder. A new technician does not need global admin rights because the previous technician had them.
Scoping access from day one means assigning the Microsoft 365 license tier the role requires, adding the user to the correct groups and shared mailboxes, and documenting what the admin configured. That documentation makes the eventual offboarding faster and less likely to leave something open.
Build a Checklist Before You Need It
The businesses that handle this well are not doing anything complicated. They have a short written checklist, one for offboarding and one for onboarding, that HR or an office manager runs through every time. logic-IT helps Georgia businesses build those checklists and, for clients on a managed services plan, handles the Microsoft 365 tasks directly so nothing waits on a busy afternoon to get done.
If your current process is informal, a termination is a good prompt to write it down. The next one will come faster than you expect.
Dealing with something similar at your business?
We can help. Talk to the logic-IT team today.