Best practices for handling Microsoft licensing when employees leave
Tag: removing a microsoft user
Publish Date
10/07/2024
Categories
Blogs Guides
Removing a former employee’s Microsoft account can be complex, and it might be challenging to determine the best approach. Should you wipe the account and set it up again? Or remove the license and then add another?
Employee turnover can make managing accounts a time-consuming task, especially with other responsibilities on your plate. To save time and focus on other IT priorities, consider outsourcing this process to Microsoft experts through a managed service. These professionals handle the secure management of your Microsoft tenant daily, ensuring your business’s data remains protected. But for the time being, below is a step-by-step guide to ensure you follow best practices, keeping your data safe and secure. While the process might seem lengthy, safeguarding your data should always be a priority.
These steps are based on Microsoft’s guidance and our own expertise.
1. Confirm Your Global Administrator Status
Ensure that you are a global administrator. Only global administrators have the necessary permissions to alter Microsoft 365 licenses and complete the following steps.
2. Block the Former Employee’s Access to Their Microsoft 365 Account
To ensure the former employee can no longer log in to their Microsoft 365 account, follow these steps to block their access:
Reset the Password to Force Sign-Out:
- Go to the admin center.
- Navigate to Users > Active users.
- Select the box next to the former employee’s name.
- Click ‘Reset password’.
- Enter a new password or use an automatically generated one. Ensure you do not email this password to the former employee!
- Click ‘Reset password’ and close the window.
- Select the former employee’s name again, and under the Account tab, click ‘Sign out of all sessions’.
Alternatively, Block the User:
- In the same Users > Active users page, instead of resetting the password, select ‘Block this user’.
- Click ‘Block sign-in’ and save changes.
Blocking a Former Employee’s Access to Email
If your M365 subscription includes email, you need to block the former employee’s access to their email as well:
- Sign in to the Exchange admin center.
- Go to Recipients > Mailboxes.
- Select the former employee’s mailbox.
- Under Email apps & mobile devices, click ‘Manage email apps settings’.
- Turn off the sliders for the following options and click ‘Save’:
- Outlook desktop (MAPI)
- Exchange web services
- Mobile (Exchange ActiveSync)
- IMAP
- POP3
- Outlook on the web
3. Preserve the Former Employee’s Mailbox Content
To ensure that the former employee’s mailbox content is saved for reference by new or current employees or for potential litigation, follow one of these options:
Option 1: Place a Litigation Hold or In-Place Hold on the Mailbox
Why Choose This Option?
- Ideal if your Enterprise plan includes archiving and legal hold.
- Necessary if litigation is a possibility.
- Suitable if you have a technically strong IT department.
Steps:
- Before deleting the user account, place a litigation hold or in-place hold on the mailbox.
- After converting the mailbox to an “inactive mailbox”, administrators, compliance officers, or records managers can use In-Place eDiscovery tools in Exchange Online to access and search the contents.
💡Note: Inactive mailboxes cannot receive email and are not displayed in your organisation’s shared address book or other lists. For detailed instructions, refer to Manage inactive mailboxes in Exchange Online.
Option 2: Export Outlook Data to a .pst File
Why Choose This Option?
- Simpler than placing a litigation hold.
- Useful if you need to transfer data to another email account.
Steps:
- Add the former employee’s email address to your Outlook on Desktop.
- Export the data to a .pst file.
- Import the .pst file to another email account as needed.
4. Wipe a Former Employee’s Mobile Device
(Skip this step if the employee did not use a company mobile device.)
- Access the Exchange Admin Center by going to the Exchange admin center. Navigate to Recipients > Mailboxes.
- Manage Mobile Devices: Select the former employee’s user account. Under Email apps & mobile devices, click on Manage mobile devices.
- Wipe Company Data: On the Mobile Device Details page, under Mobile devices, select the appropriate mobile device. Click Wipe company data, and then select Block access.
- Click Save to apply the changes.
5. Keep the Former Employee’s Email Address Active
It’s important to keep the former employee’s email address active to ensure that emails from customers or partners are directed to the person taking over their responsibilities.
💡 Note: If you’re setting up email forwarding or a shared mailbox, do not delete the former employee’s account. The account is necessary to anchor the email forwarding or shared mailbox.
Option 1: Convert the Mailbox to a Shared Mailbox
When you convert a user’s mailbox to a shared mailbox, all existing emails and calendar events are retained. This shared mailbox can then be accessed by multiple people, rather than just one.
Things to be aware of:
- This option is cost-effective as you won’t need to pay for a license if the mailbox is smaller than 50 GB. If it exceeds 50 GB, you will need to assign a license.
- All old emails will be available in the shared mailbox, which might take up considerable space.
Follow Microsoft’s guide: Convert a user mailbox to a shared mailbox – Microsoft 365 admin | Microsoft Learn.
Option 2: Forward the Former Employee’s Email to Another Employee
- Go to the admin center and navigate to Users > Active users.
- Select the name of the former employee, then select the Mail tab.
- Under Email Forwarding, select Manage email forwarding.
- Turn on Forward all email sent to this mailbox. In the Forwarding address box, type the email address of the current employee who will receive the emails.
- Select Save.
- Remember, do not delete the former employee’s account.
💡Note: Remember to cancel all meetings that the former employee had scheduled in their calendar.
6. Granting Another Employee Access
Access to OneDrive:
- Sign in to the admin center as a global admin or SharePoint admin. If you receive a message indicating you don’t have permission to access the admin center, you lack the necessary administrator permissions in your organisation.
- In the left pane, select Admin centers > SharePoint. (You might need to select Show all to see the list of admin centers.)
- If the classic SharePoint admin center appears, select Open it now at the top of the page to access the SharePoint admin center.
- In the left pane, select More features.
- Under User profiles, select Open.
- Under People, select Manage User Profiles.
- Enter the former employee’s name and select Find.
- Right-click the user and choose Manage site collection owners.
- Add the new user to Site collection administrators and select OK.
- The new user will now be able to access the former employee’s OneDrive using the OneDrive URL.
Access to Outlook:
To give another employee access to the email messages, calendar, tasks, and contacts of the former employee, import the information to the new employee’s Outlook inbox. Follow Microsoft’s step-by-step guide: Import email, contacts, and calendar from an Outlook .pst file – Microsoft Support.
7. Removing the Microsoft 365 License from a Former Employee
💡 Note: If your organisation uses Active Directory, delete and restore user accounts in your local AD service. You cannot delete or restore them directly in Microsoft 365.
When you remove a license, you can either reassign it to someone else or delete it to avoid paying for it until you hire a new employee. When a license is removed, the user’s old email, contacts, and calendar data are retained for 30 days before being permanently deleted, so it’s crucial to have M365 backup solutions in place.
Removing the License:
- In the admin center, go to the Users > Active users page.
- Select the name of the employee whose license you want to remove.
- Select the Licenses and Apps tab.
- Clear the check boxes for the license(s) you want to remove, then select Save changes.
Reducing the Number of Licenses:
- In the admin center, go to the Billing > Your products page, and select the Products tab.
- Select the subscription from which you want to remove licenses.
- On the details page, select Remove licenses.
- In the Remove licenses pane, under New quantity, enter the total number of licenses you want for this subscription in the Total licenses box. For example, if you have 25 licenses and want to remove one, enter 24.
- Select Save.
Forwarding Calls: For information on forwarding calls within your organisation, refer to the guide on Calling policies in Microsoft Teams.
Managing Microsoft licensing when an employee leaves can be a complex and lengthy process. However, ensuring it is done correctly is crucial for the security of your business and the preservation of important data. Our Microsoft experts have extensive experience securely managing organisations’ tenants, allowing businesses to focus on innovation and other priorities instead of time-consuming administrative tasks.
Our managed service offers numerous benefits, including third-party patching, ongoing monitoring for suspicious activity, and monthly reports on your tenant’s activity. For a quick, informal chat about how we can help your business, call us on 0345 223 9000 or contact us.
Recent Comments