What happens to email when an employee leaves Microsoft 365?

The answer depends on what your administrator does with the account and mailbox. Microsoft documents different paths for deleted mailboxes, shared mailboxes and inactive mailboxes. Decide which outcome you need before removing a license or deleting an account.

For a small business or nonprofit, a departing person's inbox may hold supplier conversations, donor instructions or grant correspondence. Agree who needs those records, why access is justified and how long to keep them. Put the decision in the departure checklist, alongside responsibility for checking that the chosen preservation method actually worked.

Do not treat license removal as preservation

Microsoft's license-removal guidance says the account's Exchange Online data is held for 30 days after its license is removed. Adding the license back during that grace period restores access. After the period ends, the data is deleted and cannot be recovered through that process. Holds and other mailbox states need separate consideration, so have an administrator check the actual account before making changes.

Microsoft also describes a 30-day recovery period for a deleted user account and mailbox. Treat this as a recovery opportunity, not your records policy. If the account has already been changed, give your administrator the date, the actions taken and the mailbox identity immediately rather than waiting until someone needs an old conversation.

Use a shared mailbox for an ongoing handover

If authorized colleagues need to continue using the mailbox, discuss conversion with your administrator. Microsoft's shared-mailbox conversion guidance says the user mailbox must have a license before conversion. It also says not to delete the old user account afterward: that account anchors the shared mailbox.

The same Microsoft guidance limits unlicensed shared mailboxes to 50 GB and describes additional licensing for larger mailboxes, archiving and Litigation Hold. Do not assume conversion automatically makes every mailbox free to retain. Ask your administrator to check size, required features and access permissions before removing any license.

Choose a named owner for the handover. Record which colleagues are authorized to read the correspondence and when that access should be reviewed. A mailbox that remains useful to the organization still needs a purpose and an accountable owner; it should not become a forgotten collection of personal and business information.

Use inactive mailboxes for preservation needs

Microsoft describes an inactive mailbox as a way to retain a former employee's email after their account is deleted. The sequence matters: apply the appropriate retention settings or hold, confirm that it has applied, and only then delete the account. Microsoft warns that a policy configured only to delete content does not make the mailbox inactive.

According to that inactive-mailbox guidance, the retention settings continue to apply after the account is deleted. This is not a reason to choose an arbitrary period. Ask the person responsible for records or legal requirements to specify what must be preserved, and ask your administrator to verify the required licensing and configuration before starting.

Get advice before changing a hold

A hold can be relevant when records must be preserved for a dispute or investigation. Microsoft's Litigation Hold documentation says it preserves deleted items and original versions of modified items. A hold can have a specified duration or continue until removed; when a duration is specified, it is calculated from when the item was received or created.

Do not remove a hold merely to simplify a departure or reduce a bill. Have the person responsible for the matter approve the preservation plan and any later release. This article explains product behaviour, not which legal duties apply to your organization. An administrator and the appropriate adviser should resolve that question together.

Confirm the result and keep a record

Before closing the departure task, record the mailbox's final state, the chosen retention period, the people allowed access and the person responsible for future reviews. Test an authorized retrieval of a known message. If you rely on a separate backup, confirm that the mailbox was covered before the departure and that the required records can be recovered.

KnoxDefender's Microsoft backup and restore integration remains gated on provider verification, so it must not be assumed active during offboarding. To discuss your preservation requirements and confirm current availability, see Microsoft 365 email protection and backup with KnoxDefender.