Office 365 Offboarding Best Practices

On Day 28 of Cybersecurity awareness month, learn the best practices that will help you to retain former employees’ data and protect your company from data leakage. Stay tuned for more blogs in the Office 365 cybersecurity blog series.

As an Office 365 admin, you must have an efficient Office 365 offboarding to reduce risks associated with incorrect user deprovisioning. It is also essential to retain data and protect access when an employee leaves Office 365. This blog will guide you with Office 365 offboarding best practices to eliminate data-related risks.

• To protect your company from data loss/leakage.
• It’s helpful to retain the former employee’s data.
• You can reuse the ex-employee’s license. It helps to reduce the license cost.
• It’s helpful to keep the data for legal requirements.
• To reduce the impact of business communication when an employee leaves the org (especially, the employee leaves a customer-facing team)

In this blog, we’ll walk you through the best practices to safeguard your organization’s information during the offboarding process. Plus, we’ll show you how to automate these steps using PowerShell to streamline the process and ensure no critical steps are missed. Here is the quick jump to links

• Microsoft 365 offboarding- best practices
• Automate Microsoft 365 offboarding with PowerShell

You can follow the below best practices for an effective offboarding process. It involves blocking ex-employees from accessing company files, preserving the documents they created, and performing several other admin tasks associated with removing a user.

1. Logout user from all Office 365 sessions.
2. Reset password and block account sign-in
3. Setup email forwarding
4. Convert user mailbox to shared mailbox
5. Preserve former employees’ mailbox data
6. Transfer email alias
7. Move leavers’ OneDrive data to other location
8. Wipe and block the user’s mobile device
9. Remove user from all groups
10. Remove license
11. Delete account

To remove users’ access immediately, you can force sign-out to log out of all Office 365 sessions across all devices.

How to Sign-out User from All Office 365 Sessions:

1. Log in to the Microsoft 365 admin center, select Users > Active Users > Click on the user’s Display name you want to sign out of apps and sessions.
2. Under Accounts> Sign Out, select ‘Sign out of all sessions.’
3. It can take up to 15 mins to complete the process. The person can immediately sign back in unless you have blocked their sign-in status.

To prevent a user from signing in to Office 365, you can disable sign-in or reset the password.

How to Block Sign-in in Office 365:

1. In the admin center, select Users > Active Users > Click on the user’s Display name you want to block sign-in.
2. Click ‘Block signin’ and select the ‘Block this user from signing in’ check box.
3. ‘Save’ the changes.

Blocking or disabling an account can take up to 24 hours to take effect. If you want to block users from signing in immediately, you can reset their password.

How to Reset Password in Office 365:

1. In the admin center, select Users > Active Users > Click on the user’s Display name you want to block sign-in.
2. Click ‘Reset password’ and provide a new password. (Don’t send it to them.)

You can configure email forwarding from a former employee to the person who will be taking over the work. It helps to keep the old employee’s email address active, and clients can continue contacting your organization through the former employee’s email id.

Alternatively, you can configure ‘auto reply’ for departed employees. Set up out-of-office (OOF) message that the recipient is no longer employed by your organization and their emails will not be forwarded. You can provide a replacement email address if necessary. This will prevent any potential privacy issues or unauthorized access to confidential information.

How to Setup Email Forwarding in Office 365:

1. In the admin center, select Users > Active Users > Click on the former employee.
2. Go to the ‘Mail’ tab. Under ‘Email Forwarding,’ select ‘Manage email forwarding.’
3. Turn on ‘Forward all email sent to this mailbox.’ In the Forwarding address box, type the email address of the current employee who’s going to get the email.
4. Select ‘Save.’

How to Configure Out-of-Office Reply in Office 365:

1. In the admin center, select Users > Active Users > Click on the former employee.
2. Go to the ‘Mail’ tab. Select ‘Manage automatic replies’ and turn them on.
3. You can write separate customized messages for internal and external recipients as you wish.

If you configure email forwarding or auto reply, you neither remove the license nor delete the former employee’s account.

Admins can convert a user mailbox to a shared mailbox to preserve data and connections for future use. After conversion, multiple persons can access a shared mailbox through delegation. Also, you can remove the license from a shared mailbox if it meets the following conditions.

• Mailbox size is less than 50GB
• Mailbox is not under litigation hold
• In-place archiving is disabled in the mailbox.

How to Convert User Mailbox to Shared Mailbox:

1. Go to Exchange admin center –>Recipients –>Mailboxes.
2. Select the mailbox which you want to convert.
3. Under ‘More Actions,’ click ‘Convert to shared mailbox’ and ‘Confirm‘.

It will show progress like “Mailbox is being converted from regular type to shared type.”

Even when you don’t want to keep the email id active by converting it to a shared mailbox or configuring email forwarding, you can preserve ex-employees’ mailbox data for litigation purposes.

Alternatively, converting the ex-employee’s mailbox into an inactive mailbox by applying a retention policy hold, allows you to securely preserve the data indefinitely.

How to Preserve Former Employee’s Data:

1. You can convert the mailbox to a .pst file.
2. Place litigation hold or in-place hold.
3. Convert a mailbox to an inactive mailbox.

Suppose you want to delete the former employee’s account and keep the email id active. In that case, you can remove the email alias from them and assign it to other users. You can use this method to preserve the left employee’s address.

How to Assign Email Alias:

1. In the admin center, select Users > Active Users > Click on the user’s name to whom you want to assign the alias.
2. Under Account>Aliases, click ‘Manage username and email.’
3. Assign an alias.

A user can have multiple aliases.

If you delete the user account as part of the deprovisioning process, you will lose all the data associated with that account after 30 days. It includes OneDrive and Outlook data.

How to Move Former Employee’s OneDrive Data to SharePoint:

1. In the admin center, select Users > Active Users > Click on the former employee.
2. On the user properties page, select ‘OneDrive.’ Under ‘Get access to files,’ select ‘Create link to files.’
3. Select the link to open the file location. Download the files to your computer, or select ‘Move to’ or ‘Copy to’ to move or copy them to your own OneDrive or a shared library.
4. If you only remove the license without deleting the account, the former employee’s data will be accessible even after 30 days.

If the former employee had an organization phone, you can remove all organization data and block them from accessing company data.

How to Wipe and Block Former Employee’s Mobile:

1. Log in to the Exchange admin center. Navigate to Recipients > Mailboxes.
2. Select the old user. Go to ‘Mobile Devices’ and select ‘View details.’
3. Under the Mobile Device Details page, select the mobile device, select ‘Wipe Data,’ and then select ‘Block.’
4. Click ’Save.’

You can remove the former employees from all distribution lists, and it helps keep groups free of stale accounts.

How to Remove a User from All Groups:

1. In the admin center, select Users > Active Users > Click on the former employee.
2. On the user properties page, select Groups>Manage groups.
3. Click all the groups and select ‘Remove.’
4. Select ‘Yes’ in the confirmation pop-up.

After performing the required leaver processes, you can remove the licenses from the former employees. You can assign those licenses to another user. It helps to reduce the license cost.

How to Remove a license from Old Employee:

1. In the admin center, select Users > Active Users > Click on the former employee.
2. Under ‘License and apps,’ Untick the checkboxes near the licenses you want to remove, and then click ‘Save.’
3. You can restore their data for up to 30 days after you delete them.

After saving and accessing all the former employee’s corporate data, you can delete the former employee’s accounts. Deleting users’ accounts will remove them from the admin center and keep things clean.

How to Delete a Former Employee’s Account:

1. In the admin center, select Users > Active Users > Click on the former employee.
2. Under the user’s name, select ‘Delete user.’
3. Select the required option, and then click ‘Delete user.’

Note: If you’ve already given another user access to this user’s email and OneDrive, you don’t need to do it again here.

After deleting the user, the account will be inactive for 30 days before deleting the data permanently.

To streamline the offboarding process for an M365 user, we’ve developed a PowerShell script that makes it both quick and secure. This script automates 14 best practices for offboarding, ensuring that no critical steps are missed and your organization remains protected throughout the process.

Download Script: M365UserOffboarding.ps1

For detailed script execution, you can check our dedicated blog on automate Microsoft 365 user offboarding using PowerShell.

I hope these Office 365 Offboarding processes will help you meet your business and legal requirements.