Removing a user safely in Microsoft 365

How to remove a Microsoft 365 user when someone leaves — including how to preserve their email and files before deleting the account.

When someone leaves your organization, you need to remove their Microsoft 365 account. Done carefully, this protects your data, secures your systems, and ensures their email and files are not lost.

Quick summary

Lock the account first, then sort out the email and files. In the admin center, go to Users → Active users, select the person, and choose Delete user. The Delete user page lets you hand their OneDrive content to someone else, give someone access to their email (which turns the mailbox into a shared mailbox), and drop their licence. Make those choices there — recovering data afterwards is much harder.

What you'll need

Admin access to the Microsoft 365 admin center — deleting accounts needs the User Administrator role, and removing licences from the subscription is a billing admin job
A decision on what to do with their email and files

Before you delete the account

Do this first — data can't be recovered easily after deletion

Once you delete an account you have 30 days to restore it, and after that the data is permanently deleted. Their OneDrive follows the same 30-day retention period by default; if you miss it, the OneDrive moves to the site collection recycle bin for another 93 days, and getting it back from there needs PowerShell. Always complete these steps before deleting.

Step 1: Lock them out. Reset their password and sign them out of every session first — Microsoft's own advice is that this is what stops access straight away. In Users → Active users, select the person, choose Reset password, then open their Account tab and choose Sign out of all sessions.

Step 2: Transfer their OneDrive files. If the person had files in OneDrive, you can transfer them to another user's OneDrive or download them. See Transferring files when someone leaves for a full guide. You don't need to move their SharePoint files — those stay where they are.

Step 3: Decide what to do with their email. Their mailbox can be turned into a shared mailbox so the email stays accessible, and a shared mailbox under 50 GB doesn't need a paid licence. The simplest route is to choose that option in the Delete user flow below, which converts the mailbox for you. An admin can also set an automatic reply telling senders the person has moved on.

Step 4: Remove them from shared resources. Take them off any distribution groups, shared mailboxes, and Teams channels they belong to, and cancel any meetings they had organised.

Removing the user

Sign in to the admin center at admin.microsoft.com.

Go to Users → Active users.

Find the person and select their name to open their account details. (To delete several people at once, tick them in the list, choose the three dots for more actions, and then Delete user.)

Choose Delete user.

Review the options on the Delete user page. You can choose what happens to:

Their product licence
Their email — giving another person access converts the mailbox to a shared mailbox
Their OneDrive content

Fill in the relevant fields and make your choices.

Select Delete user. You then have 30 days to restore the account before the data is permanently deleted.

Don't delete an account you've already converted or set to forward

Microsoft is explicit about this: if you have already converted the mailbox to a shared mailbox, or set up email forwarding on it, leave the account in place. Both of those still need the account to exist, and deleting it breaks them. It's also the usual cause of the error "User cannot be deleted. Please try again later."

After removing the user

Change any shared passwords they may have known (Wi-Fi, shared tools, etc.).
Check your billing — deleting the account does not stop the bill. You keep paying until a billing admin reduces the licence count under Billing → Your products → Remove licenses. See Microsoft 365 billing explained.
Review any calendar events or meetings they owned, and reassign or cancel them.
Remember what's already on their computer. If they synced or downloaded files to a personal device, there is no way to wipe those from the admin center.
If your business syncs accounts from an on-premises Active Directory, you have to delete the account there too — it can't be done from Microsoft 365.

Blocking sign-in is not instant

If you want to cut off access but aren't ready to delete the account, you can block sign-in: find the person in Active users, select Block sign-in, then Block this user from signing in and save. Microsoft warns that blocking can take up to 24 hours to take effect, so to stop someone straight away, reset their password and sign them out of all sessions as well.

Restoring a deleted account

If you deleted someone by mistake, you have up to 30 days to restore them — the account and its data come back, including the mailbox. Go to Users → Deleted users in the admin center, select the person, and choose Restore user. You'll be prompted to set a password, which you can print and hand over securely, and you'll need to assign a licence afterwards if they're going to use Microsoft 365 again.

Common questions

What happens to their Outlook email after I delete them?

If you used the Delete user page to give someone else access to their email, the mailbox becomes a shared mailbox and stays accessible to the people you add to it. If you didn't, and it's been less than 30 days, you can restore the account and get the mailbox back. Microsoft's own wording is that after 30 days the data is permanently deleted.

Will I still be charged for their license after I remove them?

Yes, until you reduce your licence count. Deleting the account doesn't do that on its own. A billing admin has to go to Billing → Your products, open the subscription, choose Remove licenses, and enter the new total. Microsoft notes that you can't remove a licence bought through a partner or volume licensing, and that if you're on an annual plan or part-way through a billing cycle you may have to wait until that commitment ends.

The person still has admin access. Do I need to do anything special?

Deleting the account removes their access along with it. Two things to watch: a Global Administrator can't remove their own Global Administrator role, so you need a second admin to do it; and Microsoft recommends having someone with the Privileged Authentication Administrator role available, so an admin who gets locked out can be recovered.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.