Our 40-person CPA or law practice has a leaver. What must happen before we delete their Microsoft 365 account or remove the licence?
Cut off the leaver's access first, then hand over their mailbox and OneDrive files to a named successor, then get the records owner's preservation decision. Only after all three are verified should anyone remove the licence or delete the account. Until then, keep the identity licensed with sign-in blocked. Convert the mailbox to shared if colleagues must keep working the old address, and delete only when nothing still depends on that identity.
Most offboarding mistakes at a 20 to 100 person practice come from treating four separate things as one click: stopping access, keeping client correspondence reachable, preserving working files, and reducing the bill. Microsoft documents each as its own step, with its own timing and its own failure mode.
Three options for a leaver's account, and when each fits
- Keep the identity licensed but block the leaver's access fits when a successor still needs live mailbox or OneDrive access, or when nobody has yet confirmed what must be preserved; avoid it as a permanent arrangement, because a licensed ghost account is a temporary holding position, not a finished offboarding.
- Convert the mailbox to shared and move needed OneDrive files to a licensed home fits when approved colleagues must keep answering the old address and reading past correspondence; avoid it if you assume the conversion also protects OneDrive, because it does not, and the files need their own move to SharePoint or a licensed OneDrive.
- Delete the account fits when no one needs the identity, its mailbox or its forwarding any more and the admin and records owner have signed off on retention and holds; avoid it while the account still anchors a shared mailbox or forwarding rule, because deleting the anchor breaks what depends on it.
Recommendation for a CPA or law practice
Start every leaver on the first option: block sign-in, keep the licence, and name the successor and a deadline in writing. Move to shared-mailbox conversion once the successor has what they need from OneDrive and the mailbox fits the shared-mailbox limits. Delete last, and only on a recorded sign-off from whoever owns client records at the practice.
The one condition that changes the order is a preservation obligation such as a litigation hold, a regulator's retention period or an archive requirement on that mailbox. When one applies, the records owner's decision comes before any licence or mailbox change, because holds and archiving can require a licence the unlicensed shared mailbox will not have.
What changed on July 1, 2026 for unlicensed OneDrive accounts
Microsoft's unlicensed OneDrive page, last updated on August 26, 2026, states: "As of July 1, 2026, unlicensed OneDrive accounts that remain unpaid are subject to a cumulative 365-day nonpayment clock." For accounts that were already unlicensed and unpaid on July 1, 2026, the same page says deletion risk begins no earlier than July 1, 2027.
A separate, shorter lifecycle runs alongside the nonpayment clock. By default, unlicensed OneDrive accounts go read-only after 60 unlicensed days and are archived after 93 unlicensed days. Tenant-wide active-storage settings can change the default active period, and the page excludes EDU, GCC and DoD tenants.
The practical reading for a practice manager: pulling a leaver's licence and walking away no longer leaves their files sitting quietly forever. A year of nonpayment is a deletion-risk window, not a guaranteed archive, and a hold on its own should not be treated as indefinite protection for an unpaid unlicensed OneDrive. Microsoft's own advice is to move actively needed content to SharePoint or a licensed OneDrive.
How the four steps behave underneath
Access cutoff is three controls, not one. Microsoft's guidance on removing a former employee, last updated on January 5, 2026, separates resetting the password, signing the user out of active sessions, and blocking sign-in. The same page warns: "Blocking an account can take up to 24 hours to take effect." Existing sessions have their own timing, so a practice handling client money or privileged files should run all three controls and not assume the block checkbox is instant.
Mailbox continuity depends on the anchoring account. Microsoft's conversion guide, last updated on February 2, 2026, requires the user mailbox to be licensed before it is converted. After conversion, a shared mailbox without a licence is limited to 50 GB, and holds or archiving can require additional licences. The guide is blunt about the account itself: "Don't delete the old user's account, because the account is required to anchor the shared mailbox."
File preservation is a separate job from the mailbox. Converting the mailbox does nothing for the leaver's OneDrive, so the successor or admin should copy the working files a matter or engagement still needs into the team's SharePoint library or a licensed OneDrive, and confirm the successor can open them, before the licence comes off.
Billing is the last and most separate step. Microsoft's delete-a-user page, last updated on February 19, 2026, tells admins to preserve email before deletion, move required OneDrive files within the configured retention period, and handle accounts synchronised from on-premises Active Directory there rather than in the cloud. It also states: "Reducing the number of licenses is a separate step that can be performed by the billing admin." Removing a licence from a user does not by itself shrink the subscription, and annual or partner commitments can delay any bill reduction.
A practice that offboards several people a year can turn these checks into a repeatable leaver workflow with approval gates, which is the kind of non-destructive automation Chrysis builds as part of its IT automation work, keeping deletion as a human-approved step. Without automation, the fallback is simple: a named tenant admin or MSP works an approved checklist, records the successor and deadlines, keeps the licence in place, and defers deletion until the practice owner and admin both confirm the handover.
Frequently asked
Does blocking sign-in stop a leaver immediately?
Not necessarily. Microsoft says a block can take up to 24 hours to take effect, so also reset the password and sign the user out of active sessions.
Does converting the mailbox to shared keep the leaver's OneDrive?
No. Shared-mailbox conversion covers mail only, so move needed OneDrive files to SharePoint or a licensed OneDrive separately.
Can we delete the account after converting the mailbox to shared?
No. Microsoft says the old user account anchors the shared mailbox and should not be deleted.
How long do unlicensed OneDrive files last now?
By default they go read-only after 60 unlicensed days and are archived after 93, and since July 1, 2026 unpaid accounts also run a cumulative 365-day nonpayment clock toward deletion risk.
Does removing the licence cut our Microsoft 365 bill?
Not automatically. Reducing the licence count is a separate billing-admin step, and annual or partner commitments can delay the saving.