How do you secure email when an employee leaves?

When someone leaves, their mailbox doesn't leave with them. It keeps receiving invoices, password resets and customer questions, and the account behind it may still work on a phone, in an old browser session or through an app password. Offboarding is when you decide who can still get in and where that mail goes next. This guide covers both, for Microsoft 365 and Google Workspace.

Why is offboarding an email security issue?

A departed employee's mailbox is a high-value, low-attention account. Nobody watches it, so a takeover goes unnoticed, and it still receives mail that customers and suppliers trust. Common gaps:

• Sessions outlive passwords. Microsoft Entra access tokens last an hour by default, and apps that issue their own session tokens control access themselves after that, according to Microsoft Learn. A password reset alone doesn't end everything.
• Converted mailboxes keep credentials. Microsoft warns that after converting a mailbox to shared, "the original username and password will continue to work" unless you reset the password.
• Forwarding goes somewhere outside. A forward to a personal address leaks every reply.
• Access runs both ways. The leaver may have Full Access to the CEO's mailbox, a shared finance inbox or someone's calendar.
• Other services trust the address. Vendor portals, domain registrars and SaaS tools send password resets to it.

If the person left on bad terms, or you suspect misuse, treat the account as compromised and follow signs your email account is compromised instead of this routine.

What is the offboarding timeline?

How do you block access in Microsoft 365?

Microsoft's former employee series sets out the order. At the time of writing (October 2026), the steps in the admin center are:

1. Reset the password and sign out. Go to Users > Active users, select the user, select Reset password, then on the Account tab select Sign out of all sessions. Microsoft says the user is prompted to sign in again "within an hour", because "an access token is good for an hour".
2. Block sign-in. Select Block sign-in and Block this user from signing in. Microsoft notes that "blocking an account can take up to 24 hours to take effect", which is why the password reset comes first.
3. Revoke sessions immediately if it matters. In PowerShell, Revoke-MgUserSignInSession -UserId <UPN> revokes refresh tokens straight away. Microsoft Entra's emergency revoke guide also shows how to disable the user's registered devices.
4. Turn off mail apps. In the Exchange admin center, under Recipients > Mailboxes > the user > Manage email apps settings, turn off Outlook desktop (MAPI), Exchange web services, Mobile (Exchange ActiveSync), IMAP, POP3 and Outlook on the web.
5. Remove app passwords and MFA methods. App passwords aren't revoked by a password reset.
6. Wipe company data from devices. In the Exchange admin center, open Recipients > Mailboxes > the user > Manage mobile devices, select a device, choose a wipe option such as Account Only Remote Wipe Device, then select Block access. Devices managed with Basic Mobility and Security or Intune can be wiped from there instead.

What should happen to the Microsoft 365 mailbox?

Pick one of four outcomes, based on whether mail must keep arriving and whether you need to keep the old content.

Shared mailbox notes

Microsoft's conversion guide lists the conditions:

• The user mailbox "needs a license assigned to it before you convert it". Remove the license afterwards.
• "Without a license, shared mailboxes are limited to 50 GB."
• To put a hold on a shared mailbox, you need an Exchange Online Plan 2 license, or Plan 1 with the Exchange Online Archiving add-on.
• "Don't delete the old user's account, because the account is required to anchor the shared mailbox."
• "Inbox rules are preserved after the user mailbox is converted", so review them; an old forwarding rule keeps forwarding.
• Reset the password and keep sign-in blocked. Microsoft's shared mailbox guidance says to "always block sign-in for the shared mailbox account".

Retaining mail you can't delete

If you must keep the content but don't need new mail, apply a Microsoft 365 retention policy, confirm it's applied, then delete the account. Microsoft says the mailbox then becomes an inactive mailbox kept for the retention period. Without a hold, the data "is retained for 30 days" after the account is removed and then permanently deleted. Microsoft also notes that forwarding and shared mailbox conversion don't work on a mailbox that's inactive for compliance reasons, so choose one path. Check licensing for retention and inactive mailboxes in Microsoft's current service descriptions before you rely on it.

How do you offboard a user in Google Workspace?

Google's data security checklist for departing employees has seven steps:

1. Wipe the user's mobile devices from the Admin console, either the whole device or only your organization's data.
2. Remove the user's recovery email address and phone number.
3. Change the user's password.
4. Revoke OAuth 2.0 application tokens. Google notes that a password change revokes tokens only "for accessing certain products".
5. Reset the user's sign-in cookies.
6. Revoke security keys and app passwords.
7. Delete the account, after moving any data you need. Google calls this "the best way to ensure they can't access your organization's data."

Suspend, archive or delete?

Google's suspension page says "new email and calendar invitations are blocked" for suspended users, and archived users likewise "can't receive new email". If customers still write to the address, arrange delivery first.

When you delete a user, Google's deletion guide offers to migrate their email to another account or redirect incoming messages to another address, and to transfer Drive files and calendar events. You can restore a deleted account for up to 20 days. After that the address is removed from Google Workspace, and Google warns that "a deleted user's data is unrecoverable once it's deleted."

How should you handle forwarding and auto-replies?

Forward to a colleague or a shared mailbox inside the organization, never to the leaver's personal address. Set an end date, such as 90 days, and put it in your calendar. Before turning on forwarding, check the account for old inbox rules and existing forwards; the tenant-wide checks in malicious inbox rules and auto-forwarding apply here too.

An auto-reply helps customers, but keep it short:

• Say the person no longer works here and give a role address, such as sales@, not a named colleague's direct line.
• Don't explain why or when they left.
• Don't include bank details or new payment instructions; that's a gift to anyone planning invoice fraud.

Our guide to out-of-office auto-reply risks explains what attackers learn from them.

What access do people forget to remove?

Delegate access, both ways

Remove other people's access to the leaver's mailbox once handover is done, and remove the leaver's access to everyone else's. In Exchange Online, Get-MailboxPermission -Identity <mailbox> -User <leaver> returns the permissions a user has on a mailbox; loop it over your mailboxes to find Full Access grants. Check Send As and Send on Behalf permissions, shared calendars and shared mailboxes too. In Gmail, check Settings > Accounts for mail delegation.

Groups and lists

Remove the account from distribution lists, Microsoft 365 groups, Google Groups and Teams. An account left in a list keeps receiving group mail, including into any forwarding you've set up. If the leaver owned groups, assign a new owner. For tighter control of who can mail big lists, see restrict who can email distribution lists.

App grants and app passwords

Review the enterprise apps and OAuth grants the user consented to and revoke them. Microsoft notes that app passwords aren't automatically revoked when you reset a password, and Google lists revoking app passwords as a separate step, so remove them explicitly.

Services registered to their address

List outside services that send to the leaver's address: domain registrar, DNS host, bank portals, payroll, cloud consoles, social media, suppliers' portals. Move each to a role address you control. A registrar login tied to a departed employee's mailbox can be slow and difficult to recover.

Offboarding checklist

1. Reset the password from a trusted device.
2. Sign out of all sessions and revoke refresh tokens.
3. Block sign-in or suspend the user.
4. Turn off mail apps and protocols (Microsoft 365) or reset sign-in cookies (Google).
5. Remove app passwords, MFA methods, security keys and recovery details.
6. Revoke OAuth app grants.
7. Wipe company data from phones, tablets and laptops.
8. Decide the mailbox outcome and set it up before removing licenses.
9. Review the mailbox's inbox rules and forwarding.
10. Set internal forwarding and a short auto-reply, both with an end date.
11. Remove the leaver's delegate access to other mailboxes, and others' access to theirs when handover ends.
12. Remove them from groups and lists, and reassign ownership.
13. Move vendor and service accounts to role addresses.
14. Record what you did, when and who did it.

Next steps

• Turn the checklist into a ticket template that HR triggers automatically when someone gives notice.
• Audit current accounts for people who've already left. Look for licensed accounts with no recent sign-ins.
• Use role addresses for supplier and service accounts from the start, so a departure doesn't strand them.
• Keep spam and phishing away from shared and handover mailboxes, which nobody owns closely. iBlockSpam filters every mailbox on a domain at the MX, with a quarantine and digests for each address.

Browse our other email operations guides.