Key takeaways
Onboarding should give each new hire only the access their role needs and get MFA registered on day one.
Offboarding starts by blocking sign-in and ending active sessions, then preserves email and files before any license or account is removed.
Order matters: deleting a user too early starts Microsoft's deletion clock on their OneDrive, which by default keeps files for 30 days.
Secure onboarding means a new employee gets exactly the access their role needs, with multi-factor sign-in (MFA) set up on day one. Secure offboarding means a departing employee loses access promptly, while their email and files are preserved for whoever takes over. In Microsoft 365, the order of the steps matters, especially when leaving, and the checklists below are built around that order.
Why it matters
Accounts that outlive the people who used them are one of the most common findings in any Microsoft 365 review. A former employee who can still read email is a confidentiality problem. An account with no MFA that nobody watches is an easy target. On the other side, deleting an account too quickly can lose client files that only existed in that person's OneDrive.
Onboarding checklist
1. Create the account with your standard naming format, and record the start date and manager.
2. Assign the right license for the role. Do not default everyone to the most expensive plan.
3. Add the person to role-based groups (for example, Accounting or Project Staff) rather than granting access file by file. Give admin rights only if the role truly needs them, and then through a separate admin account.
4. Register MFA on day one. If you use Microsoft's Security Defaults, users must register for MFA at first sign-in; Microsoft removed the old 14-day grace period in 2024.
5. Set up the computer: company-owned where possible, with disk encryption, endpoint protection and updates in place before it is handed over.
6. Grant access to shared resources: shared mailboxes, Teams, SharePoint sites and line-of-business apps, again through groups where you can.
7. Cover the basics in a short first-day session: how to sign in, where files belong, how to spot phishing, and how to ask for help.
Offboarding checklist
Work through these in order. For a planned departure, schedule the first three for the moment the person's last day ends. For an unplanned or contentious departure, do them immediately.
1. Block sign-in. In the Microsoft 365 admin center, select Block sign-in on the user. Microsoft notes this can take up to 24 hours to take full effect, so do the next two steps as well.
2. Reset the password, so any saved or shared password stops working.
3. Sign out of all sessions. Microsoft notes users are typically prompted to sign in again within about an hour; an administrator can revoke sessions immediately with PowerShell.
4. Remove MFA methods and app passwords registered to the user, especially any authenticator on a personal phone.
5. Wipe or retrieve devices. Collect company computers. For phones with company data, remove company data or wipe the device using your device management tools, and block the device from email.
6. Decide what happens to email. Convert the mailbox to a shared mailbox so a colleague can read past mail, or forward new mail to a colleague. Do not delete the account behind a shared mailbox or forwarding; Microsoft requires it as an anchor.
7. Hand over OneDrive files. Give a manager or colleague access to the person's OneDrive and have them move anything the business needs into SharePoint before the account is deleted.
8. Remove licenses only after data is safe. A shared mailbox under 50 GB does not need a license as of this writing; over that, it does.
9. Remove the user from groups, Teams, shared mailboxes and distribution lists, and from external apps such as your CRM, accounting system and any single sign-on apps.
10. Review links the person shared, particularly Anyone links to client files, and remove the ones that are no longer needed.
11. Delete the account only when you are sure nothing else depends on it.
Microsoft details worth knowing
OneDrive retention
When a user account is deleted, Microsoft keeps their OneDrive for a retention period that defaults to 30 days and can be extended in the SharePoint admin center. The manager is notified and given access by default. After that, it sits in a recycle bin for 93 days and can only be restored by an administrator.
Unlicensed OneDrive accounts
If you remove a license but keep the account, Microsoft archives unlicensed OneDrive accounts after 93 days and may charge for archived storage. Do not leave unlicensed accounts sitting indefinitely.
Shared mailbox limits
As of this writing, an unlicensed shared mailbox is limited to 50 GB. Larger mailboxes, archiving and litigation hold need a license.
Old password on a converted mailbox
Microsoft notes that if you convert a mailbox to shared without resetting the password, the original username and password still work. That is why blocking sign-in and resetting the password come first.
Microsoft changes these details from time to time, so check its current documentation before relying on a specific number.
A worked example
Take a hypothetical 22-person insurance agency where a producer leaves on a Friday. At 5:00 PM the office manager's ticket triggers the first steps: sign-in blocked, password reset, sessions revoked, MFA methods removed. On Monday the laptop is collected, the mailbox becomes a shared mailbox for the producer's successor, and the successor is given access to the OneDrive to move client files into the agency's SharePoint. Two weeks later, once the successor confirms nothing is missing, the license is removed and the person is taken out of the CRM and quoting tools.
Common mistakes
• Removing the license first and assuming that locks the person out.
• Deleting the account before anyone has copied the OneDrive files.
• Converting a mailbox to shared without blocking sign-in or resetting the password.
• Forgetting apps outside Microsoft 365 that use separate logins.
• Leaving the old account active indefinitely because nobody owns offboarding.
How NexJen can help
Onboarding and offboarding of staff are included in NexJen Essentials, our managed IT plan, alongside Microsoft 365 management and a security baseline that includes MFA. You send a request through our help desk and we work through the checklist with you. If you manage IT yourself, our Microsoft Entra ID consulting engagement can review how accounts, groups and admin roles are set up today and give you a written plan.
Common questions
Does removing a Microsoft 365 license block the user?
Not reliably on its own. Block sign-in, reset the password and sign the user out of all sessions first.
How long are a deleted user's OneDrive files kept?
By default, 30 days after the account is deleted, then 93 days in a recycle bin where only an administrator can restore it. The 30-day period can be extended.
Should we convert a former employee's mailbox to a shared mailbox?
Often, yes. It keeps past email available to colleagues, and as of this writing it needs no license if it is under 50 GB. Keep the underlying account; do not delete it.
Is offboarding included in NexJen Essentials?
Yes. Onboarding and offboarding of staff are part of the plan.
Want staff changes handled for you?
NexJen Essentials includes onboarding and offboarding of staff, along with Microsoft 365 management and security.