Microsoft 365 offboarding: plan the handover

Agree the decisions first

Start with the person authorising the departure and the manager taking over the work. Record the employee’s sign-in email address, when changes should happen and who is responsible for checking the result.

• Access: which accounts, devices and services must be dealt with, including anything outside Microsoft 365?
• Email: does a colleague need to read the existing mailbox, handle incoming messages or send from its address?
• Files and ownership: who needs the employee’s OneDrive files, shared documents and ownership of ongoing work?
• Retention: are there instructions to preserve information before changing the account or its licences?

Microsoft’s former-employee guidance covers the wider process, including devices, files and account deletion. The script below handles selected account and mailbox actions; completing it does not complete the whole handover.

What the script can do

Offboard-User.ps1 is for ordinary cloud-only member accounts. Choose the actions for one employee, review the current settings and confirm once before changes run.

Block sign-in

Prevent new sign-ins to the selected Microsoft 365 account.

Request session revocation

Request that existing sign-in sessions are revoked. An accepted request is not proof that every session has ended immediately.

Convert to a shared mailbox

Keep the mailbox for an agreed handover. Conversion is a separate choice from blocking sign-in.

Grant a colleague Full Access

Allow the chosen colleague to open and manage the mailbox. This action does not grant Send As permission.

The script does not delete the account, remove licences, manage OneDrive, set retention or handle synchronised on-premises accounts. Allocate those decisions separately.

A shared mailbox’s size, archive, hold and other features can affect its licensing needs. Check Microsoft’s shared-mailbox requirements before removing any licence.

Preview before making changes

Download the ZIP from the resource library, extract it and read the included guide. Review and test this beta script in a non-production environment first. The guide lists the Microsoft modules and permissions required for each action.

In a fresh PowerShell window, open the extracted folder and start with a read-only check:

.\Offboard-User.ps1 -WhatIf

Enter the employee’s sign-in email and choose the proposed actions. Sign in through Microsoft with an authorised account, then check the tenant, employee and proposed changes. -WhatIf makes no tenant changes; it still saves a local audit log. Further employees checked in that session stay in preview mode.

When the preview is understood and the work is authorised for the agreed time, start a new run without -WhatIf:

.\Offboard-User.ps1

Review the choices again before confirming. The script skips settings already in the requested state.

Check the result and finish the handover

Each run saves one audit.json in a new Outcomes folder. Read the individual results: a completed action, a skipped setting and a request needing review are different outcomes.

Check any uncertain result in Microsoft 365 before retrying. Confirm the intended colleague can access the mailbox, record the outstanding file and licence decisions, and return the handover record to the person responsible.

Keep the audit in an approved location: it contains account and administrative information. If you need to review the mailbox’s permissions afterwards, use the shared mailbox permissions guide.