Offboard Microsoft 365 users: transfer ownership before disabling the account
Diesen Beitrag auf Deutsch lesen
A five-step offboarding flow: trigger from the HR leaving date, hand over Teams, sites, apps and flows, move OneDrive data, reclaim licenses, then verify.
TL;DR
Disabling a leaver's account stops sign-in, not the leftovers: Teams and sites with a disabled sole owner, OneDrive files deleted after retention, flows running under the departed user's connections, licenses still billing. Trigger offboarding from the HR leaving date, add a new owner to every Team, site, group, app and flow, move needed OneDrive content, revoke sessions, reclaim licenses, then verify a week later.
Original by Torsten Mandelkow, on Rencore Blog. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Admins/CoE: Trigger offboarding from the HR leaving date, not memory, list every Team, site, group, app and flow the leaver owns, add a new owner to each before the account is disabled, and check a week later that nothing is left with a disabled owner.
- Security/Compliance: Revoke sessions and tokens in the same step as disabling, check retention policies and legal holds before deleting OneDrive content, and keep the record of what was handed over, to whom and when.
- Leadership/Business: A disabled account with a license still costs money every month, so reclaim licenses as part of the process and give managers the checklist before the last day.
Frequently asked questions
Is disabling a user account in Entra ID enough to offboard someone?
No. Disabling stops sign-in, but everything the person owned stays in place, a disabled owner still counts as an owner, and sessions and tokens may stay valid for a while.
What happens to a leaver's OneDrive files after the account is removed?
Microsoft deletes the OneDrive a set period after account removal unless a retention policy or hold applies, so move needed files to a team site first.
What happens to Power Automate flows owned by a departed employee?
They keep running under the departed user's connections and go unmaintained, so add a new owner to each flow and app before disabling the account.