Former Employee Mailbox: What to Do in Microsoft 365

The colleague is gone, but their mailbox isn't. And customer inquiries are still landing there.

"Please forward Mr. …'s emails to our office address starting Friday." That was the short request a planning firm sent to its IT service provider. An employee was leaving the company, and his emails shouldn't go nowhere. What was then carried out was considerably more than forwarding: redirection with an end date, user disabled, permissions and groups removed, mailbox converted to a shared mailbox, hidden from the address book, license removed.

That list is exactly the point. When an employee leaves, it isn't just about emails, but about access, data and costs. Here is the process in Microsoft 365.

What should happen to the mailbox?

In most cases: convert it to a shared mailbox. That has three advantages:

• The emails are kept, which matters for customer history, quotes and orders.
• Authorized colleagues can access it without knowing the former employee's password.
• The license becomes free, since shared mailboxes don't need their own license up to 50 GB.

Simply deleting the mailbox, by contrast, is risky: once the recovery period expires, the emails are gone.

Step 1: Block sign-in and end sessions

Close access first, on the last working day, not weeks later.

• Microsoft 365 admin center › Users › Active users › user › Block sign-in.
• Sign out of all sessions, so that signed-in phones and browsers are disconnected too.
• Reset the password in case it is saved somewhere.
• Mobile devices: remove or reset them in Exchange or Intune (wipe company data).
• On-premises Active Directory: disable the account if it is synced.

With PowerShell (Microsoft Graph):

Connect-MgGraph -Scopes "User.ReadWrite.All"
Update-MgUser -UserId "[email protected]" -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId "[email protected]"

Step 2: Remove groups and permissions

Over the years, an account collects many groups: distribution lists, Teams, SharePoint sites, drive shares, VPN access, applications. In the real-world case, there were a good dozen groups, from "All employees" through project groups to access for remote access and applications.

Remove them all, and document them first in case a successor needs the same permissions:

Get-ADUser "mitarbeiter" -Properties MemberOf | Select-Object -ExpandProperty MemberOf

Don't forget: access outside Microsoft 365: line-of-business software, online portals of suppliers and banks, cloud services, shared passwords that the employee knew.

Step 3: Convert the mailbox

Microsoft 365 admin center › Users › Mail tab › Convert to shared mailbox.

With PowerShell:

Connect-ExchangeOnline
Set-Mailbox -Identity "[email protected]" -Type Shared

Then grant permissions to the colleagues who need access:

Add-MailboxPermission -Identity "[email protected]" -User "[email protected]" -AccessRights FullAccess -AutoMapping $true

Step 4: Forwarding or automatic reply

Two ways to keep emails from going nowhere:

• Way: Forwarding to colleagues or a central address – Advantage: nothing gets lost; Disadvantage: private or confidential emails also end up with the colleague
• Way: Automatic reply naming a new contact person – Advantage: senders know right away, more privacy-friendly; Disadvantage: senders have to write again

The combination often makes sense: an automatic reply for everyone, plus time-limited forwarding of business emails to a central address.

Set up forwarding:

Set-Mailbox -Identity "[email protected]" -ForwardingAddress "[email protected]" -DeliverToMailboxAndForward $true

With -DeliverToMailboxAndForward $true, a copy stays in the mailbox, so everything remains traceable.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

Important: Exchange has no built-in expiry date for forwarding. Set a fixed date, in the ticket system or calendar, on which the forwarding is removed. In the real-world case, exactly that was done.

Automatic reply with a time period:

Set-MailboxAutoReplyConfiguration -Identity "[email protected]" -AutoReplyState Scheduled `
  -StartTime "2026-10-01" -EndTime "2026-12-31" `
  -ExternalMessage "Mr. … is no longer with the company. Please contact [email protected]." `
  -InternalMessage "No longer with the company. Please contact [email protected]."

Step 5: Hide from the address book and remove the license

Set-Mailbox -Identity "[email protected]" -HiddenFromAddressListsEnabled $true

Then, in the admin center under Licenses and apps, remove the license, only after the conversion, otherwise the mailbox is deleted when the grace period expires. What happens when licenses drop away unplanned is described in Outlook hangs on “Loading Profile”.

Exceptions: Mailboxes over 50 GB, with an archive or with a retention policy (such as a litigation hold) still need a suitable license.

What about OneDrive and the files?

OneDrive data is part of this too. When the license is removed or the account is deleted, OneDrive is only kept for a limited time. Beforehand:

• Give the manager or successor access to the OneDrive (offered in the admin center when deleting the user) or move the files to a Teams or SharePoint location.
• Check sharing: files the employee shared with external partners.

What does data protection say?

The mailbox can also contain private or confidential emails. Therefore:

• Set the rules in advance, ideally in an IT policy that every employee knows (whether private use is allowed or not, what happens when someone leaves).
• Limit access to the people who need it for business.
• Put a time limit on forwarding.
• Observe retention periods before the mailbox is permanently deleted. Business correspondence is often subject to statutory periods.

If in doubt, coordinate with the data protection officer.

The checklist in short

1. Block sign-in, end sessions, remove mobile devices
2. Remove groups, permissions and external access (document first)
3. Convert the mailbox to a shared mailbox, grant the successor permissions
4. Automatic reply and/or time-limited forwarding: set a date for removal
5. Hide from the address book
6. Hand over OneDrive
7. Remove the license
8. After the periods expire: delete permanently

The reverse direction, a new employee taking over the workstation, is covered in the IT checklist for new employees.

How does SuperSupport help when employees leave?

Requests like "Please forward Mr. …'s emails" rarely contain everything IT needs to know. The SuperSupport agent asks in the conversation about the cutoff date, the forwarding target, the duration, access to files and the successor, and hands IT a complete case. The implementation in Microsoft 365 stays with IT. What this looks like for internal IT teams and MSPs is explained on the respective pages.

Frequently asked questions

What do I do with the mailbox of a former employee?

In Microsoft 365, it is usually converted into a shared mailbox. That way the emails are kept, colleagues can access them if needed, and the license can be removed. In addition, sign-in is blocked and the mailbox is hidden from the address book.

Does a shared mailbox need a license?

Not up to 50 GB. Larger mailboxes, archives or retention policies such as a litigation hold still need a suitable license.

Can I forward the emails to a colleague?

Business emails, as a rule yes, for a limited time and with a clear purpose. Because a mailbox can also contain private or confidential messages, an automatic reply naming a new contact person is often the more privacy-friendly solution. The company's rules should be set beforehand.

How long should the forwarding run?

Until customers and partners know the new contact person, usually a few weeks to a few months. Exchange has no built-in expiry date for forwarding, so plan a fixed date to remove it.

Can the mailbox be deleted later?

Yes, if no retention obligations stand in the way. Beforehand, check whether business emails, such as invoices or contracts, are archived elsewhere, and observe the statutory retention periods.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial