The Leaver's Laptop Isn't the Whole Story: Untangling Email, Files and Licences After Someone Goes

The assumption that causes trouble

When someone hands back their laptop, it's tempting to think the job is done. The desk is clear, the pass is returned, and the team can get on with things. In the cloud, though, the person's working life is still sitting in a tenant: email, files, calendar entries, chat history, forwarding rules, delegated access, and a licence that may still be billing every month.

Most small firms assume that when an account is disabled, everything is neatly archived or deleted. The reality is more uneven. Microsoft 365 and Google Workspace both have sensible defaults, but those defaults are not a plan. They are a starting point that assumes somebody has decided what should happen to the data.

That decision belongs to the business, not the platform. And in a UK small firm, it usually needs to be made by a line manager, an office manager, or whoever holds the finance and HR reins that week.

What happens by default — and what people think happens

In Microsoft 365, blocking sign-in stops the person logging in, but it doesn't automatically remove their mailbox, OneDrive, or licence. If you remove the licence, the mailbox and OneDrive move into a deletion window. The exact timing depends on the licence and retention settings, but the important point is that the clock often starts when the licence is removed or the account is deleted, not when the person walked out of the door.

Google Workspace behaves differently again. A suspended user can remain suspended with data intact for a period, and deleting the account is a separate decision. Drive files, Gmail, and calendar data don't simply transfer themselves to the manager because the laptop has been wiped.

The common mistake is assuming that 'the IT person will sort it'. In many small firms there isn't an IT person, or there's one person wearing three hats. Offboarding becomes a password reset and a shrug.

Shared mailboxes: useful, but not a free-for-all

Converting a leaver's mailbox to a shared mailbox is often the right move when the email address needs to keep receiving messages — for example, a sales inbox or a finance address that customers and suppliers still use.

In Microsoft 365, a shared mailbox under the standard size limit generally doesn't need its own licence, which is one reason it's popular. But it isn't a set-and-forget solution. You still need to decide who can access it, who can send as it, and how long it should exist. And you need to remove the leaver's delegate access and any rules they created.

The lazy version — reset the password and let a colleague log in as the departed person — is a bad idea. It breaks the audit trail, confuses MFA, and leaves a named account active when it shouldn't be. It also makes it harder to prove who sent what if a customer dispute lands on your desk.

Delegated access and forwarding: the quiet back doors

This is where offboarding often goes wrong. In Microsoft 365, check for Full Access permissions, Send As, and Send on Behalf permissions. In Google Workspace, check Gmail delegates and calendar sharing. Remove anything that isn't deliberately needed.

Then look at inbox rules and forwarding. A leaver may have set up an auto-forward to a personal Gmail address, or a rule that quietly copies invoices to an external account. Microsoft and Google both have controls around external forwarding, but the settings vary and aren't always switched on in the way you'd expect.

Also check transport rules or admin-level forwarding that might sit above the individual mailbox. The point isn't to assume malice. It's to make sure the business knows where its email is going after someone leaves.

OneDrive and Drive: hand over the files before you delete the account

Files are the part people remember — usually after the account has gone. In Microsoft 365, OneDrive data can be accessed by an admin during the retention window, but it's much easier to transfer or grant access before the licence is removed. In Google Workspace, you can transfer Drive files from one user to another, but it needs doing deliberately.

Don't copy everything into a personal folder and hope for the best. Decide which files belong to the business, which are needed for an ongoing project, and which can be archived or deleted. Check sharing links too; a leaver's files may have been shared externally in ways nobody remembers.

Devices, sessions and the bit everyone forgets

A returned laptop is not the same as a secure laptop. If the device is managed through Intune, Google Endpoint Management, or another tool, you can remote wipe it after any file handover is complete. If it's not managed, you need a manual plan for local files, browser profiles, saved passwords, and any synced cloud accounts.

Don't forget phones and tablets. Revoke active sessions, remove the device from email access, and change any shared passwords the person knew. If BitLocker recovery keys or device passcodes were stored somewhere shared, review that too.

And don't wipe the device before you've recovered what the business needs. That sounds obvious. It is also one of the most common offboarding regrets.

The GDPR and ICO angle

Under UK GDPR and the Data Protection Act 2018, personal data must not be kept for longer than necessary. An ex-employee's mailbox often contains personal data about customers, colleagues, and suppliers. Keeping it forever because 'it might be useful' is not a retention policy.

The ICO's guidance is not about deleting everything instantly. It's about having a lawful reason, a retention period, and appropriate security. If there's a genuine need to keep the mailbox — for example, an ongoing contract dispute or a legal hold — restrict access and record why. If there isn't, delete it on a schedule.

A simple retention decision on the offboarding checklist is worth more than a vague promise to tidy up later. Write down what you kept, why, who can access it, and when you'll review it.

Common failure modes

• The leaver still receives invoices because the email address was never redirected or the supplier was never told.
• A shared password is known by half the office and nobody changes it.
• A manager has permanent full access to an ex-employee's mailbox because it was easier than setting up a shared mailbox.
• The licence is still being paid for six months after the person left.
• OneDrive files disappear because the account was deleted before anyone checked what was in it.
• The laptop is returned but never wiped, and local files sit on it in a cupboard.

A simple offboarding checklist for line managers

1. Confirm the last working day and who owns the handover.
2. Decide what happens to email: shared mailbox, delegate access, retention, or deletion.
3. Transfer OneDrive or Drive files to the right person or team.
4. Review inbox rules, forwarding, delegates, and calendar sharing.
5. Remove the leaver's access to shared passwords and systems.
6. Block sign-in and revoke active sessions.
7. Reclaim the licence only after the data decision is made.
8. Recover and wipe devices, including phones and tablets.
9. Record what was kept, why, and when it will be reviewed.
10. Tell relevant suppliers and customers about the new contact where needed.

Make it boring

Offboarding doesn't need to be dramatic. It needs to be repeatable. A one-page checklist, a named owner, and a calendar reminder to review retained data will prevent most of the mess.

If your small firm doesn't have anyone who wants to own this, that's exactly the sort of thing a managed IT provider can take off your hands. But even without one, a line manager with a checklist can stop the ghost in the tenant from becoming a ghost in the accounts.