What this check looks at
Checks disabled member accounts, which is how most leavers end up, for what should have gone with them: paid licences, admin roles, and mail still being forwarded outside the organisation. Free licences, such as Office 365 A1, cost nothing and are left out; a paid student licence, such as Microsoft 365 A3 for students, still counts.
When someone leaves, most organisations block their sign-in and stop there. A disabled account cannot sign in, but everything attached to it carries on: its admin roles stay assigned, its mailbox keeps receiving mail while server-side forwarding and inbox rules keep running, and its licences keep being billed.
This check looks at disabled member accounts and flags any that still hold a directory role, still forward mail outside the organisation (mailbox forwarding and inbox rules read from Exchange), or still hold a paid licence (free licences, such as Office 365 A1, cost nothing and are left out; paid student licences still count). The check fails when any disabled account holds a role or forwards mail externally. It warns when the only problem is paid licences, or when mail forwarding could not be read for every mailbox, so offboarding cannot be confirmed.
External forwarding on a leaver’s mailbox sends company mail to a personal or competitor’s address every day, often set up by the leaver in their last week. An admin role on a disabled account comes back the moment anyone re-enables it, for example to export the mailbox. A paid licence on a disabled account is cost for nothing.
Why it matters
Disabling a leaver is only the first step. A disabled account that still forwards mail sends company information to a personal address every day; one that keeps an admin role is a ready-made route back in if it is re-enabled; and a paid licence left on it is paid for every month.
A sales director leaving a 50-person distributor sets an inbox rule forwarding all mail to their personal address before their last day. IT disables the account, but the rule keeps running on the server for months, sending customer enquiries, prices and contract renewals to someone now working for a competitor. It is a data breach and a commercial loss, found only when a customer mentions a quote from the rival firm.
Completing offboarding takes a few minutes per person and is the same every time, so it belongs on a checklist with an owner.
ISO 27001 A.5.11 (return of assets), A.5.18 (access rights) and A.6.5 (responsibilities after termination or change of employment), CIS Controls v8 safeguards 6.2 (access revoking process) and 5.3, Cyber Essentials’ user access control requirement and the NCSC CAF identity and access management outcome all expect a leaver’s access to be removed completely.
How to fix it
Where: Microsoft 365 admin centre → Users → Active users → the user → Licences and apps / Mail
Before you start
- Confirm each person has left, and agree with their manager who needs their mail or files.
Step by step
- Review each leaver. Open the evidence: each disabled account is listed with what is left (roles held, external forwarding, licences). Confirm with the manager that the person has left and who needs their mail and files.
- Remove admin roles. In the Microsoft Entra admin centre, Entra ID > Users > the account > Assigned roles, select each role and choose Remove assignment. Check ID Governance > Privileged Identity Management > Microsoft Entra roles > Assignments for eligible assignments too.
- Remove forwarding and forwarding rules. In Exchange Online PowerShell, clear mailbox forwarding with Set-Mailbox -Identity <upn> -ForwardingSmtpAddress $null -ForwardingAddress $null -DeliverToMailboxAndForward $false. List forwarding inbox rules with Get-InboxRule -Mailbox <upn> | Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } | Format-List Name, ForwardTo, RedirectTo, and remove each with Remove-InboxRule -Mailbox <upn> -Identity "<rule name>".
- Check what was sent out. If mail was forwarded outside, run a message trace in the Exchange admin centre (Mail flow > Message trace) for messages from the mailbox to that address over the last 90 days, and decide with the client whether it is a personal data breach to report to the ICO within 72 hours.
- Keep the mail and files that are needed. If colleagues need the mail, convert the mailbox to shared (Exchange admin centre > Recipients > Mailboxes > the mailbox > Convert to shared mailbox) and give the manager access. Give the manager access to the OneDrive content from the user’s OneDrive tab in the Microsoft 365 admin centre and move what the business needs.
- Remove the licences. In Users > Active users > the user > Licences and apps, untick the paid licences and Save, or remove the user from the licensing group if licences come from a group.
- Close the remaining access. Revoke sessions (Revoke-MgUserSignInSession -UserId <upn>), remove the account from groups and Teams, remove any delegate access it held to other mailboxes, and wipe or retire its devices in Intune.
- Update the leaver checklist and confirm. Add these steps, in this order, to the client’s leaver checklist with an owner, so the next leaver is complete on the day. The finding clears at the next assessment once none of the listed accounts holds a role, forwards mail outside or holds a licence.
What users will notice
None for current staff.
How to confirm it worked
The listed leavers have no admin roles, forwarding or paid licences at the next assessment.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | User access control |
| Cyber Essentials Plus | User access control |
| NCSC CAF | B2.d Identity and access management (IdAM) |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-4 Review and reconcile user access regularly |
| Zero Trust | Identities |
| SOC 2 | CC6.2 User registration, authorisation and removal |
| PCI DSS 4.0.1 | 8.2.5 Access for terminated users is immediately revoked |
| NIST SP 800-171 | 3.9.2 Protect systems during and after personnel actions such as terminations |
| CMMC Level 2 | PS.L2-3.9.2 Personnel Actions |
| ISO 27001:2022 | A.5.11 Return of assetsA.5.18 Access rightsA.6.5 Responsibilities after termination or change of employment |
| CIS Controls v8.1 | 6.2 Establish an access revoking process (IG1)5.3 Disable dormant accounts (IG1) |
| NIST CSF 2.0 | PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organizationPR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access managementData security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Remove a former employee (Microsoft Learn)