Someone is leaving. How do I shut off their work accounts?
Updated October 30, 2026
Lock the account first, decide what to keep second, and delete last, if at all. On their last day, reset their Microsoft 365 password, sign them out everywhere, and block sign-in. Keep the account so their email and files stay available, save what you need, then shut off every other app they used, change shared passwords they knew, and collect their devices. A written checklist keeps anything from being skipped.
Steps
- Make the list before their last day: every account they sign in to for work, every shared password they know, and every company device they have.
- Check they aren’t your only administrator. If they are, give someone else administrator access to Microsoft 365 and your domain before anything else.
- Reset their password, sign them out, and block sign-in, in that order. The reset works fastest; a block can take up to 24 hours.
- Clear their sign-in methods, so their phone no longer works as a second step. Check for passkeys and security keys too.
- Keep their email reachable by forwarding it or converting the mailbox to a shared mailbox. Both need the account to stay in place.
- Save the files you need from their OneDrive to a shared location before anything is deleted.
- Shut off everything else on the list and change shared passwords, starting with banking, payroll, and administrator accounts. Collect company devices.
- Remove or reassign the license last, after any mailbox conversion, and write down what you did and when.
Details
Why the order matters
Lock first, decide what to keep second, and delete last, because each step is harder to undo than the one before it. Resetting the password and signing them out works fastest, though Microsoft notes it can take up to an hour before they’re asked to sign in again. Blocking sign-in can take up to 24 hours, which is why it backs up the reset instead of replacing it. Deleting the account, or removing its license, starts the clock on losing their email and files.
Where to click in Microsoft 365
All of these are done by an administrator:
- Reset and sign out: in the Microsoft 365 admin center, go to Users > Active users, select their name, and choose Reset password. Then, on the Account tab, select Sign out of all sessions (Microsoft: Prevent a former employee from signing in).
- Block sign-in: on the same user page, select Block sign-in.
- Clear sign-in methods: in the Microsoft Entra admin center, go to Entra ID > Users, select their name, open Authentication methods, and choose Require re-register MFA. Microsoft says this removes registered phone numbers and authenticator apps (Microsoft: Manage authentication methods). It doesn’t cover passkeys, security keys, or a password-reset email address, so delete any still listed on that page.
- Save their files: on their user page, the OneDrive tab has Create link to files (Microsoft: Give another employee access to OneDrive and Outlook data).
- Work email on their own phone: in the Exchange admin center, go to Recipients > Mailboxes, select their name, choose Manage mobile devices, select the phone, choose Account Only Remote Wipe Device, then Block access. This removes only the work account (Microsoft: Wipe and block a former employee’s mobile device).
Forward their email, or keep the mailbox?
Convert to a shared mailbox if anyone needs their old email; forward it if only new messages matter. Forwarding sends new messages to the person taking over. A shared mailbox keeps the old email and calendar too, and several people can open it. Convert first, then remove the license: Microsoft says the mailbox needs a license at the moment you convert it, and a shared mailbox under 50 GB doesn’t need one afterward (Microsoft: Convert a user mailbox to a shared mailbox). If you’re only forwarding, keep the license, because Microsoft deletes the mailbox 30 days after the license is removed (Microsoft: Remove a license from a former employee).
When the departure isn’t friendly
Shut off access during or right before the conversation, not afterward. Change shared passwords at the same time, and get company devices back before they leave the building. If there’s any chance of a dispute, check with your attorney before you delete their email or files. If a laptop doesn’t come back, treat it as missing: Company laptop lost or stolen? What to do right now.
Make the next one routine
A written checklist, updated whenever you add an app, catches the step that usually gets missed. In our experience, that step is rarely Microsoft 365. It’s the app someone signed up for on their own, or the password everyone shares. Two habits make the list shorter:
- Sign up for business apps with a shared company address, not a personal one, so the account doesn’t leave with the person.
- Use “Sign in with Microsoft” where an app offers it. Blocking the Microsoft 365 account then stops new sign-ins to those apps too, so fewer need their own shutoff. Still check each one, since an app can stay signed in for a while.
Shutting off access is easy to do but has to happen every time, so give it a named owner.
For IT PLZ HELP clients, setting up new employees and shutting off access when they leave is part of the service, handled the same way each time and documented.
Where doing it yourself gets risky
- Deleting or unlicensing too soon. Microsoft keeps a former employee’s email for 30 days after the license is removed, and a deleted account’s OneDrive files for 30 days by default. After that, they’re gone.
- The account nobody knew about, such as a vendor portal or social media page they signed up for with their own email address.
- Shared passwords left unchanged, like the Wi-Fi password or a login the whole office uses.
- Email quietly going elsewhere. Check their mailbox for forwarding or inbox rules that send company email to an outside address.
Signs it’s time for help
Get help if any of these is true. If you have administrator access, you can do the Microsoft 365 steps yourself.
- The person leaving was your only administrator.
- They set up systems nobody else understands.
- The departure isn’t friendly, and everything needs to be shut off at once.
Today, start a one-page leaving checklist with every account and shared password on it, so the next departure is routine instead of guesswork. If someone is leaving soon, or you’d like help building the list, we’re glad to go through it with you.
Book a free 20-minute fit check