An authorised business and IT process
These checks help plan technical preservation and continuity. The business decides employment matters, authorised audience and applicable privacy/retention requirements.
Step 1 of 9
In this guide
Agree authority, timing and data responsibilities
Agree authority, timing and data responsibilities
Have the business’s authorised people and IT owners confirm the departure timing, affected identity, required business records and who may receive access. Keep employment and personal details private. An administrator’s technical ability to open an account does not by itself decide who should see its contents.
Agree any applicable record-retention, legal hold, privacy or investigation requirements with the responsible owner before deletion or licence changes. This guide describes technical planning; it does not decide employment action or which legal obligations apply. If there is a suspected account compromise, use the incident process promptly alongside preservation.
Record the approved tasks, owners, dates and acceptance checks. Microsoft’s offboarding overview separates access control, mailbox/data preservation and licensing. Do not start by deleting the user or handing the former identity and password to a replacement employee.
Confirm the authorised timing, data scope, audience and retention responsibilities. Separate employment decisions, access control and preservation before destructive changes.
Next: Inventory where the business information really livesInventory where the business information really lives
Inventory where the business information really lives
List the relevant OneDrive locations, SharePoint/Teams shared libraries, mailbox/archive, local-only files and app-managed records. Identify the actual owner/source rather than rely on a shortcut, synced folder name or one computer’s Desktop. Include recent unsynchronised edits and information on authorised work devices.
Identify shared-resource ownership and dependencies: teams/sites, calendars, automated workflows, forms or apps that rely on the departing identity. A colleague seeing a shared link does not mean that colleague owns the files or that the resource will survive every account change.
For each source, record what must be retained, who needs ongoing access, where it should live and how completeness will be verified. Keep the inventory private. Do not copy personal information wholesale into another employee’s account or assume one mailbox conversion preserves all files and services.
Identify the real sources, current edits, owners and dependencies. Define the approved retained content and destination for each workload.
Next: Have the owner secure access without losing the dataHave the owner secure access without losing the data
Have the owner secure access without losing the data
At the authorised time, have the responsible administrator use the supported identity process to block inappropriate access and revoke sessions as required. Microsoft’s access-control guidance distinguishes password, session and sign-in actions. Their effects are not identical or universally immediate across every client/service.
Account synchronisation/federation and device/application access may require changes at the authoritative system. Have the owner check the actual environment and connected services. Do not create a new global administrator, bypass policy, give a replacement employee the old password or assume removing an app licence terminates every session.
Preserve required data and recovery arrangements while securing access. Company-owned and personal devices, selective business-data removal and a full device wipe are different matters needing their own authority and preservation plan. Do not erase a device, mailbox or OneDrive as an automatic access-blocking step.
Use the authorised identity owner and verify access-control scope. Preserve required information; licence removal or a changed password alone is not a complete offboarding result.
Next: Preserve files in an approved owned destinationMore checks6 detailed checks
Preserve files in an approved owned destination
Preserve files in an approved owned destination
Through the authorised administrator, confirm access to the actual OneDrive and identify current required files before any deletion or licence removal. Microsoft’s data-access guidance describes supported delegation and preservation. Limit access to the approved scope and record any temporary delegation for later review.
Choose an appropriate business-owned destination such as the intended SharePoint library, with the correct ongoing owner and audience. Agree whether a supported copy, move, export or retention/recovery mechanism meets the requirement. Version history, metadata, permissions and links do not automatically survive every method; Microsoft’s offboarding instructions explicitly note limitations for the described copy/move workflow.
Preserve the original required source and current work until completeness and usability are accepted. Check recent edits, skipped items, required history and any sharing dependencies. Use file-sync and sharing checks for real location/access problems. Do not overwrite newer work, export the whole account to personal storage or call a successful download a complete backup.
Preserve approved files with an accountable destination and audience. Verify the actual method’s content/history/metadata/link limits before releasing the source.
Next: Decide mailbox continuity and preservation separatelyDecide mailbox continuity and preservation separately
Decide mailbox continuity and preservation separately
Agree whether the business needs authorised access to historic mail, a shared mailbox, a retained mailbox under an applicable policy, an export or an appropriate new-contact response. Forwarding future messages is not a complete historic archive. Local mail archives and unsent work need their own assessment.
Microsoft’s shared-mailbox conversion guidance explains that the underlying account must remain as the mailbox anchor. Size, archive/hold features and the actual product rights can require licensing. Conversion alone does not stop the former user signing in, and it does not preserve OneDrive or every linked app.
Have the authorised owner configure only approved delegates, mail routing and continuity, preserving needed records and reviewing existing rules/forwarding. Do not broadly forward all mail outside the business, delete messages merely to fit a licence limit, remove a required hold or delete the account anchoring a shared mailbox.
Agree historic preservation and future-mail continuity independently. Preserve required mailbox identity/licensing and keep approved delegates and routing narrow.
Next: Transfer shared-resource ownership and working dependenciesCheck current retention, backup and licence effects
Check current retention, backup and licence effects
Before removing a licence or deleting an identity, have the administrator confirm the actual workload state, configured retention/holds, archive status, recoverability and commercial requirements. OneDrive, Exchange and SharePoint do not share a single universal recovery window, and configured preservation is different from ordinary user access.
Microsoft’s current unlicensed OneDrive policy includes read-only, archive, access and payment-state consequences; it is not a promise that an undeleted unlicensed user’s files stay readily accessible forever. The deleted-user retention guidance also depends on actual settings and delegation. Record the relevant dates and owner-supported action before a deadline, without blindly applying older overview summaries.
Check the actual independent backup scope, history and tested recovery path if that is part of the preservation plan. Sync, a bin, an archive and retention are different mechanisms. Use the Microsoft 365 backup/recovery guide. Removing an assigned licence, reducing paid seats and cancelling a commitment are separate actions; preserve required data and rights before any authorised commercial change.
Record the actual workload/policy/account/payment state and preservation deadlines before licence or deletion decisions. Do not substitute sync, a generic window or an untested archive for a usable recovery plan.
Next: Verify the approved handover and record outstanding itemsVerify the approved handover and record outstanding items
Verify the approved handover and record outstanding items
With the responsible owners, verify the intended access restrictions and relevant sessions/service dependencies to the agreed scope. Do not casually sign in as the former employee, send live customer mail or erase a device to test the process. Record any delay or untested context rather than claim all access is gone instantly.
Confirm the approved successor can access usable current business files and mail in their own authorised context, with required history, permissions and ownership accounted for. Test harmless representative tasks and the relevant recovery method. Check the preservation inventory against the result; a link opening is not proof every required record was retained.
Record the change, approved audience, retained sources, outstanding gaps, follow-up dates and owner acceptance. Review temporary delegates and continued licence/storage obligations as planned. Deletion or disposal remains a separate authorised decision after preservation and applicable requirements are satisfied. Do not mark the whole offboarding complete while a required source or dependency remains unresolved.
Verify both access-control scope and usable authorised handover, preserve evidence and record remaining obligations. Keep untested or incomplete work open.
Back to the symptom checkerGet help with a specific offboarding data risk
Get help with a specific offboarding data risk
Provide the authorised timing, account state, relevant data sources, desired successor access and exact issue privately. Explain whether a licence or identity was already removed, whether content is archived/deleted and which sources/backups are available. Do not include passwords, employee records, whole mailboxes or unrestricted file links in an initial enquiry.
Our Microsoft 365 backup service and Microsoft 365 support pages can start a discussion about the actual preservation and handover scope. Agree ownership, permissions, policy/licensing and recovery verification before disruptive work.
If a deadline has passed or data is missing, ask the authorised administrator to check the actual available recovery state promptly. Do not assume a new backup can recover information it never captured, or that a deleted account is always restorable. Keep technical support separate from the business’s employment, privacy and legal decisions.
Use the authorised owner with the precise workload, state and required outcome. Agree preservation and recovery limits without disclosing private employment records.
