What should happen to a leaver's email, files and phone number?

Why does this matter more than it used to?

Removing access on someone's last day is well understood. What happens to their data afterwards isn't, and Microsoft has made the default outcome less forgiving.

Since July 2026, a OneDrive account left without a licence goes read-only after 60 days, is archived after 93 days and, if nobody pays to keep it, faces deletion after 365 days. Getting files back from the archive means setting up pay-as-you-go billing and paying a reactivation fee (Microsoft Learn). The old habit of "remove the licence and we'll look at it later" can now cost money, or the files.

Phone numbers have a similar trap. In Microsoft Teams, removing the phone licence unassigns the number, and with Direct Routing it removes the number from the system altogether (Microsoft Learn). If a customer rings that number next week, nobody answers.

In what order should you do it?

Order matters. Get it wrong and you lose data or leave a door open.

What should you do with a leaver's email?

You have three choices, and most businesses use the first.

Convert to a shared mailbox. All existing email and calendar stay in place, and the people who need them are given access. There's no licence cost as long as the mailbox is under 50 GB. Don't delete the user account afterwards: the shared mailbox needs it as an anchor (Microsoft Learn). Block sign-in on the account so it can't be used to log in.

Forward new email to a colleague. Only new messages are sent on, and the account must still exist. It suits the first few weeks.

Export and delete. Cheap, but the exported file is a copy you then have to secure and track.

Whichever you choose, set a date. Shared mailboxes for people who left years ago are common in audits. The ICO is clear that there's no fixed retention period for workers' information: it's up to you to decide how long you need it, record that, and delete or anonymise it when you no longer do (ICO). Six to twelve months is a common choice for a leaver's mailbox where there's no dispute, but agree yours with whoever handles HR and legal matters.

If a dispute or legal claim is possible, talk to your IT provider before converting anything. A legal hold keeps everything, including deleted items, but needs the right licence in place first.

What should you do with their files?

OneDrive is personal storage. When someone leaves, their work files should move to where the team can find them: the SharePoint site or Teams channel for that client, project or department.

Microsoft lets an admin give another user access to a former employee's OneDrive, and gives you 30 days after an account is deleted to restore it (Microsoft Learn). After you remove the licence, the unlicensed OneDrive clock starts: read-only at 60 days, archived at 93. So the safe order is to move the files first and remove the licence afterwards.

Two further checks. Links the leaver shared from their OneDrive stop working once the account goes, so re-share anything still in use from the SharePoint copy. And if you use a Microsoft 365 backup service, confirm how long it keeps a removed user's data.

What should you do with their phone number?

The desk or Teams number. Reassign it to the person taking over, or point it at a call queue or auto attendant, before you remove the leaver's phone licence. On 8x8 and 3CX the principle is the same: move the number, then remove the user. Update any call flows and hunt groups (groups of phones that ring together) the leaver was part of, or calls will ring a user who no longer exists.

The business mobile. If the mobile is on the company's account, the number belongs to the business. Keep the SIM active and either give the handset to the replacement or move the number onto a new SIM. Wipe the old handset through Intune before it's reissued.

If the leaver wants to keep the number. This happens a lot with salespeople and long-serving staff. It's the company's decision, not theirs. If you agree, the account holder requests a PAC code and the leaver's new provider ports it. Ofcom's rules mean the number should normally be working on the new network within one working day, and the PAC lasts 30 days (Ofcom). Before agreeing, think about who rings that number: if it's your customers, they will follow the person, not the business. Put your policy in the employment contract or mobile policy so it isn't negotiated at the door.

Worked example: an account manager leaves

Example (an illustration, not a real client): an account manager at a 30-person Edinburgh firm resigns and works four weeks' notice. She has a 32 GB mailbox, 18 GB in OneDrive, a Teams phone number that's on the website, and a company mobile her clients use.

During her notice, her manager lists her clients and the files she uses. On her last day, IT blocks her sign-in, signs her out everywhere, wipes the company mobile and sets an automatic reply naming her replacement. That week, her mailbox becomes a shared mailbox for her manager and replacement, and her client folders move into the "Clients" SharePoint site. Her Teams number is reassigned to her replacement, and her mobile number moves onto a new SIM in his handset. Only then is her licence removed. The shared mailbox is marked for deletion after 12 months, in line with the firm's written retention schedule.

Nothing is lost, nothing is paid for twice, and no client rings a dead number.

How Indigo does this. Indigo Unified Communications' Glasgow service desk runs leaver requests alongside everything else: 1,854 tickets in September 2026, with a 13-minute average first response. We're a Microsoft Solutions Partner for Modern Work with 100+ Microsoft 365 migrations completed, we back up Microsoft 365 with Datto SaaS Protection and document every client's set-up in IT Glue. On the phone side we support 8x8, 3CX and Microsoft Teams Phone, and our mobile team manages business numbers on EE, O2 and Vodafone. Managed IT support →

What to do next

1. Write a one-page leaver checklist in the order above, and give it to whoever tells IT that someone is leaving.
2. Check for existing unlicensed OneDrive accounts in your Microsoft 365 admin centre, and move any files you still need before they're archived.
3. Set retention periods for leavers' mailboxes and files, and record them in your retention schedule.
4. Add a mobile number clause to your contracts or mobile policy saying numbers on the company account stay with the business.
5. Book a free IT health check if you'd like us to review your joiner and leaver process.