What Happens to a Staff Member’s Email When They Leave?

Nothing happens on its own, and that is the problem. When someone leaves, their mailbox keeps receiving customer email, their password keeps working, and their licence keeps costing you money until somebody acts. Done properly, the mailbox is kept, handed to the right person and locked down in four steps on their last day.

Why it matters

A departed staff member’s mailbox usually holds live customer conversations, supplier quotes and the odd invoice. You want all of that kept and someone watching it. At the same time, that account is now a door into your business that nobody is standing behind. Email addresses turn up in data breaches all the time, and an account with a known password and nobody using it is exactly what an attacker hopes to find.

The four steps

1. Convert the mailbox to a shared mailbox. The email, folders and history all stay, and the licence is freed so you stop paying for it. A shared mailbox is free on Microsoft 365.
2. Give access to the right person. The manager, or whoever is taking over the customers, opens the shared mailbox alongside their own in Outlook. New mail to the old address lands there and gets answered.
3. Block sign in on the old account. The person can no longer sign in, on any device, anywhere.
4. Reset the password and sign out every session. Even with sign in blocked, we change the password to something long and random and end any session still open on a phone or laptop.

Steps three and four are the ones that get skipped, and they are the ones that close the door.

What about their files and phone

Files saved in their OneDrive are handed to their manager automatically for a period after the account is disabled. Anything in Teams or SharePoint stays where it is, because it belongs to the business, not the person. If they used a work phone, it is wiped of business data from the admin side before it comes back.

Auto reply or not

Many businesses set an automatic reply on the old address for a few months, telling senders who to contact now. It is a small courtesy that stops customers wondering why nobody answered.

When to do it

On the day they leave, not the week after. If notice has been given, the steps can be prepared in advance and run in a few minutes once they have walked out. For every business we look after, this is a standard procedure, and it is one of the items we check in a security review.

If you have staff who left months ago and you are not sure what state their accounts are in, that is worth a look now rather than later. It is a short job under managed IT support or on its own.

Do we lose their emails if the licence is removed?
Not if the mailbox is converted to a shared mailbox first. Remove the licence without converting and the mailbox is deleted after a grace period.

Can the person still read their old email after they leave?
No. Once sign in is blocked and sessions are ended, the account is closed to them.

How long should we keep the shared mailbox?
As long as it is useful. Many businesses keep it for a year, then archive it.

If this is happening in your business and you would like it sorted, call DM1 on (08) 6202 6012 or send us a message. We look after IT, Microsoft 365, websites and domain names for Perth small businesses.