Posted On 04 Mar 2021
It has been estimated that on leaving their employment up to 50% of former employees still have access to their company’s IT systems through Office365. This clearly represents a significant security threat; even if an employee has left on the best possible terms, you can’t expect them to be as careful about security as they move on from your employment as they were when working for you. If an employee has left with any sort of grudge, clearly the potential for them to cause damage to your systems if they retain IT access is immense. Below we set out four ways in which you can make sure that you remain protected against damage to your system, deliberate or otherwise, from former employees retaining access to Office 365.
Block access/sign out: make sure a leaving employee is fully signed out of all accounts and sessions to which they had access. Make sure that this applies on all devices, including any they may be taking away with them, e.g. cell phones or tablets belonging to the employee on which they did company work. If you won’t be needing any access to their account, you can choose to block all sign-ins from it. Sometimes you might need to continue accessing the account to retrieve data etc., in which case it’s a good idea to change the account password.
Managing mailbox access: there are a number of processes you can use to change an employee’s mailbox settings. You can turn on automatic email forwarding, so that all email address to your former employee is forwarded to a current one; you may wish to turn on automatic replies, so anyone emailing the former employee will be told that they no longer work for you and are given an alternative contact; or, if you wish to continue to access existing emails, you can convert the mailbox to a shared one (this has the advantage of giving other people access without having to purchase an extra license).
License/app removal: under the “licenses and apps” button, you can make changes to the Microsoft 365 license. If you remove an employee’s license, all data held in their account will be deleted 30 days later; by converting to a shared mailbox (see above) you can save having to buy new license, or you can downgrade your license now the employee won’t be needing all applications.
Link to OneDrive: in the former employee’s area you can click on “Create link to files” which will give you a link to all the former employee’s OneDrive files that you can then pass to another employee. Best practice is for the new employee to make copies of all the OneDrive files they will need within 30 days of terminating the former employee’s account.
