How to offboard a user in Microsoft 365

Offboarding a user in Microsoft 365 is a sequence, not a delete button: block sign-in and revoke sessions on the last day, redirect or preserve the mailbox, hand the OneDrive to the manager, wipe corporate data from devices, remove group memberships and licences, and delete the account on a schedule once the hold and handover decisions are made. Skip the sequence and you get one of the classic failures — the mailbox that vanished with the licence, the personal phone still syncing mail, the shared-drive owner who no longer exists.

The process design, roles, and the HR trigger are in the offboarding process guide; automating the whole thing is what Entra ID Lifecycle Workflows is for. This page is the manual runbook for one leaver.

Prerequisites

• User Administrator (block, licences, delete), Exchange Administrator (mailbox), SharePoint Administrator (OneDrive), Intune Administrator (devices). Global Admin is not required and should not be used.
• A trigger from HR with the leaving date and time, the manager's name, and whether legal hold applies.
• For hybrid identities: the account is disabled and moved in on-premises AD, and Entra Connect syncs the change; cloud-side blocks are additional, not instead. Which sync you have is in Entra Connect vs Cloud Sync.

Steps

1. Block sign-in and revoke sessions (last day, at the agreed time)

Microsoft 365 admin center → Users → Active users → the user → Block sign-in. Then in Entra, on the user, Revoke sessions. Tokens for Exchange, SharePoint, and Teams are cut within minutes through Continuous Access Evaluation. For scripted offboarding:

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
Update-MgUser -UserId leaver@contoso.com -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId leaver@contoso.com

Reset the password too, so a re-enabled account is not re-enabled with the old credential. If the person had admin roles, remove them now and check PIM eligible assignments.

2. Decide the mailbox path

One of three, per the FAQ: convert to shared (how to convert a mailbox to shared), place on litigation hold for an inactive mailbox, or keep licensed for a fixed handover period. In every case set an auto-reply naming the new contact and, if wanted, mail forwarding to the manager:

Connect-ExchangeOnline
Set-MailboxAutoReplyConfiguration leaver@contoso.com -AutoReplyState Enabled -ExternalAudience All `
  -InternalMessage "This person has left. Contact successor@contoso.com." -ExternalMessage "This person has left. Contact successor@contoso.com."
Set-Mailbox leaver@contoso.com -ForwardingAddress successor@contoso.com -DeliverToMailboxAndForward $true

3. Hand over OneDrive

SharePoint admin center → More features → User profiles → Manage User Profiles → the user → Manage site collection owners to add the manager now, or rely on the automatic manager access at deletion. Confirm the retention setting under Settings → OneDrive → Retention is what the policy says (default 30 days). The manager gets an email with a link when the account is deleted. Content that must outlive the person should be moved to a SharePoint site — see the OneDrive-vs-SharePoint rule in What is OneDrive.

4. Wipe corporate data from devices

Intune admin center → Devices → the user's devices. Corporate-owned: Wipe (or Retire if the device is being returned and re-imaged anyway). Personal devices with app protection policies: Apps → App selective wipe → Create wipe request for the user, which removes Microsoft 365 app data without touching the phone. Autopilot devices being returned need the Autopilot registration kept; only reset them. Details in how to remote wipe a lost device with Intune.

5. Remove memberships, ownerships, and licences

Check Entra → the user → Groups and Owned objects: reassign ownership of any Microsoft 365 group, Team, or app registration the person solely owns, or the group expiration policy will later have nobody to email. Remove the user from licensing groups (or the direct licence) after the mailbox decision in step 2 has been executed — removing a licence deletes a regular mailbox after 30 days.

6. Delete on schedule

After the agreed period (commonly 30 days), delete the account in the Microsoft 365 admin center or, for hybrid, delete/move it in on-premises AD. It sits in Deleted users for 30 days and can be restored in full during that window. Held mailboxes become inactive; OneDrive follows the retention setting.

Verify

• Sign-in logs show only failures for the account after the block time.
• The mailbox responds with the auto-reply; forwarding delivers to the successor; if converted, it shows as SharedMailbox.
• Intune reports the wipe/retire as completed; the device no longer appears under the user.
• After deletion: the manager received the OneDrive access email; Get-Mailbox -InactiveMailboxOnly lists the mailbox if a hold applied; licence count decreased.

Roll back

Within 30 days of deletion, Users → Deleted users → Restore brings back the account, mailbox, OneDrive, group memberships, and licences (if still available). Re-enable sign-in and reset the password. After 30 days, the account is gone; mailbox content survives only if a hold applied (restore it via New-MailboxRestoreRequest from the inactive mailbox), and OneDrive only within its retention period — the OneDrive recovery guide covers what is still possible.