When a user leaves the company, you want to ensure their account is taken care of. This means you must forward their email, reset their password, and either forward or grant another user full access to their mailbox. In this article, you will learn how to offboard an employee in Microsoft 365.
Step 1. Disable the user
Disable the user in on-premises AD and ensure that it’s synced and that the account in Microsoft Entra ID gets locked as well. Many organizations move the disabled user to an OU, but they don’t sync it to the cloud. That’s incorrect because you want the disabled users to be synced, so the account in the cloud is also blocked.
Step 2. Reset user password
Reset their password in on-premises AD. Once done, it will also sync the password to the cloud using Microsoft Entra Connect.
Step 3. Transfer email alias to another mailbox
Move the alias addresses to another mailbox that will use them. If they are not needed, you can keep them or remove them.
Step 4. Remove user from all groups
Go to the user properties in on-premises AD. Remove the user from the on-premises groups. And if you have Microsoft 365 groups in your organization set up, ensure that you also remove the user from the groups in the cloud.
Step 5. Log out of all sessions
Ensure you log out the user from all sessions. This is from on-premises AD and Microsoft 365. Read more in the article Force sign-out users in Microsoft 365 with PowerShell.
Step 6. Convert user mailbox to shared mailbox
The mailbox conversion must be performed using the Exchange Management Shell (on-premises) if you have an Exchange Hybrid environment. Once the Microsoft Entra Connect Sync runs, the mailbox will appear as converted in the cloud. After that, you can remove the license associated with it. Read more in the article Convert user mailbox to shared mailbox in Exchange Hybrid.
However, if the mailbox is over 50 GB, you can still convert it, but you may not be able to remove the license afterward.
I always recommend purchasing Exchange Online Plan 2 for mailboxes that exceed 50 GB, as it ensures the mailbox remains active. This plan can be assigned to either a user or a shared mailbox. While it does cost more than not paying a license, it’s not overly expensive.
Step 7. Remove any delegation from the mailbox
If nobody needs access to the account, remove all delegations from the mailbox unless you know exactly who requires access to it. You don’t want other users to remove emails and so on.
Step 8. Hide mailbox from GAL
When you disable a user, and they are no longer present in the company, you don’t want users to find them in the Global Address List (GAL). So, hide the mailbox from the GAL.
Step 9. Set up email forwarding
Some users want their email forwarded to their new work address, which is an external address. By default, the email forwarding feature is disabled in Microsoft 365 for security reasons.
If you want to forward the email to an external email, Enable external forwarding in Microsoft 365 for the selected group first, as you don’t want it set for all users.
You can enable email forwarding using various methods. I recommend using the Microsoft 365 admin center. This allows all admins to view the settings in the admin center easily.
Test the configuration by sending a test email and verify that it’s forwarded successfully. It’s important to confirm everything is working as expected.
Step 10. Export PST file
If you decide to stop forwarding after a few months and want to remove the license, you can Export the Microsoft 365 mailbox to a PST file and keep it offline for future reference.
Step 11. Remove license
Remove the license from the user if you want to delete the user account or if the license is no longer needed. For example, you converted it to a shared mailbox, and it’s under 50 GB of data. Otherwise, you need to keep the license assigned.
Step 12. Delete user account
The last step is to delete the account. Do this from the on-premises Active Directory environment, and it will sync to the cloud using Microsoft Entra Connect. The user account in the cloud will also be removed.
That’s it!
Read more: Permanently delete users from Microsoft 365 »
Conclusion
You learned how to offboard an employee in Microsoft 365. There are many steps involved, and every organization is different. Ensure you have a good checklist and keep it up to date, as things may change. Once you have a solid template, it’s time to automate everything with PowerShell.
Did you enjoy this article? You may also like How to Download All User OneDrive Files. Don’t forget to follow us and share this article.