An employee leaves: when do you remove the Microsoft 365 licence?

Good offboarding prevents two problems at once: a former employee keeps no access, and colleagues lose no information they still need.

The principle: close the door first, then secure the data, only then free up the licence, and the account last of all. In steps, it looks like this.

1. 1Close off access. Block sign-in and revoke the sessions, so that a phone or laptop that is already signed in is logged out too. If the account comes from on-premises Active Directory, disable it there; otherwise the synchronisation switches it back on.
2. 2Decide what you keep. Does the mail need to stay for colleagues (convert to a shared mailbox), for laws or regulations (retention policy or litigation hold, see below), or not at all?
3. 3Convert the mailbox to a shared mailbox while the licence is still assigned. Without a licence you will not see the option.
4. 4Give the manager or successor access to the shared mailbox and set an automatic reply that points to the right colleague.
5. 5Sort out OneDrive. Have the manager or successor move the files that are still needed to a SharePoint site or their own OneDrive.
6. 6Reset the password. After the conversion, the old username and password keep working on the shared mailbox.
7. 7Remove the licence, but only if the mailbox is under 50 GB and does not need a hold.
8. 8Delete the account later, or not at all. A converted shared mailbox needs the account as its anchor, so do not delete it while you are using the mailbox.

Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"
Connect-ExchangeOnline

$upn = "jan.jansen@bedrijf.nl"

# 1. Close off access
Update-MgUser -UserId $upn -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $upn

# 3. Convert, check the size first
Get-MailboxStatistics -Identity $upn | Select-Object DisplayName, TotalItemSize
Set-Mailbox -Identity $upn -Type Shared

# 4. Add the manager and set an automatic reply
Add-MailboxPermission -Identity $upn -User "petra.devries@bedrijf.nl" -AccessRights FullAccess -InheritanceType All
Set-MailboxAutoReplyConfiguration -Identity $upn -AutoReplyState Enabled -InternalMessage "Jan werkt hier niet meer. Neem contact op met Petra de Vries." -ExternalMessage "Jan werkt hier niet meer. Neem contact op met Petra de Vries."

# 7. Free up the licence
$sku = Get-MgSubscribedSku -All | Where-Object SkuPartNumber -eq "SPE_E3"
Set-MgUserLicense -UserId $upn -AddLicenses @() -RemoveLicenses @($sku.SkuId)

A shared mailbox is often a practical solution, for example when customers still reply to old emails.

Converting to a shared mailbox (convert to shared mailbox) is the usual way to keep the mail of an employee who has left without continuing to pay for a licence. All mail and calendar items stay in place. In the admin center you go to Users > Active users, choose the user and, on the Mail tab, Convert to shared mailbox. A few conditions do apply.

Whoever opens the shared mailbox does need an Exchange Online licence of their own; the shared mailbox itself does not. Which permissions to give the manager, and why automapping through a group does not work, is covered in shared mailboxes and mailbox permissions. In a hybrid Exchange environment you convert the mailbox with the cmdlets of your on-premises Exchange; otherwise the synchronisation may turn it back into a user mailbox.

Freeing up the licence is not always the right choice. In these cases you keep it, or you take a different route:

• Litigation hold or an ongoing investigation. A mailbox without a licence can no longer be searched with eDiscovery, and a hold on a shared mailbox requires a licence on that mailbox.
• A mailbox larger than 50 GB that you want to keep as a shared mailbox: that requires Exchange Online Plan 2.
• An archive mailbox that has to come along: without a licence the shared mailbox has no larger archive.
• OneDrive you want to keep accessible for longer than 93 days without moving the files. After 93 days without a licence it is in the archive.

If you only need to keep the mail for compliance and nobody needs to work in it, an inactive mailbox is often better than continuing to pay for a licence. You put a retention policy on the mailbox, check that the hold has really been applied, and then delete the account. The mailbox is then kept for as long as the policy says, and the licence is freed up. Microsoft recommends a retention policy for this rather than litigation hold.

The last working day is busy. Without fixed steps, removing a licence quickly comes loose from keeping the right data.

Every step above is easy enough to do. The problem is that there are eight of them, in a fixed order, on a fixed day, and that IT usually only hears about that day if someone remembers to pass it on. A leaver who comes in a week late means an active account for a week, or a licence that was already gone before the mailbox was converted. A leaver who never comes in at all means a licence that keeps running for months; that is what reducing Microsoft 365 licence costs is about.

The full offboarding story in Entra ID, with devices, MFA methods and applications outside Microsoft 365, is in offboarding in Entra ID. Why it is precisely when people leave that things so often get left undone, you can read in automatic deprovisioning.