Employee Left the Company Get Mailbox Access the Proper IT Way
When someone leaves, the instinct to 'just recover the password from their PC and log in' is understandable — and wrong. The organisation already owns a better set of levers: the admin controls. This page is the proper offboarding route for mailbox access, step by step.
By Technical AnshuWindows 10 / 11 - Outlook8 minute read
Watch the full video - the authorised Outlook password recovery process, shown step by step
The authorisation frame is different here and worth stating plainly: the mailbox belongs to the organisation, and access after departure must flow from management or HR instruction through the admin accounts — documented, attributable, and reversible. Extracting a departing employee's saved personal password and signing in as them fails every test: it is unauditable, it may expose their personal accounts where passwords were reused, and it muddies legal evidence. The admin route below achieves everything the business legitimately needs, cleanly.
Offboarding order for a leaver's mailbox (example timeline)
Hour 0Block sign-in and revoke sessions
Hour 0Reset the password through the admin center
Day 1Manager access by delegation or shared mailbox - not by password
Day 30Archive or export per policy, then remove the licence
NeverRecover their saved password and sign in as themNOT THE ROUTE
Caption: sequence matters — access for the business flows through admin grants that can be logged and later removed.
1
Why the Saved-Password Shortcut Is the Wrong Tool
It helps to name the problems precisely, because the shortcut genuinely looks efficient:
Attribution dies. Every action taken while signed in as the leaver is recorded as the leaver's action. If anything is later disputed — a deleted mail, a sent message — the logs point at the wrong human.
It over-collects. People reuse passwords. Their mailbox password may also open personal services; the company has no right to that key, and holding it is a liability.
It bypasses process. HR, legal holds and investigations depend on access being granted deliberately. A quiet password recovery short-circuits all of it.
It is unnecessary. Every legitimate goal — reading project mail, handing over clients, preserving records — has a cleaner admin mechanism below.
2
Step One — Secure the Account Before Anything Else
On the leaver's last day, or immediately on an unplanned exit, the admin sequence starts with control, in the Microsoft 365 admin center or the on-premise directory:
Block sign-in on the account so no new sessions can start.
Revoke sessions / sign out everywhere so existing tokens on phones and home PCs die at once — modern sign-in makes this one action, one of its biggest offboarding advantages.
Reset the password to a strong admin-held value. This is a reset through the directory — the supported route — not a recovery of their old one.
Remove the account from the leaver's personal devices via device wipe of company data where MDM is in place.
Only after the account is secured should anyone discuss who reads the mail. Security first, access second, always in that order.
3
Step Two — Give the Business Access by Delegation, Not Impersonation
The manager or the covering colleague needs the project history — grant it in a way that keeps names honest:
Full Access delegation — the delegate opens the mailbox as an additional mailbox inside their own Outlook, signed in as themselves. Every read and send is attributable.
Convert to a shared mailbox — the classic pattern for role mailboxes (sales@, support@): several staff work it, no licence needed in many plans, and nobody ever needs the old password.
Auto-reply and forwarding by rule — set an out-of-office telling senders the new contact, so the business stops depending on the archive quickly.
Export or archive for records — where policy or law requires retention, produce a proper export under the retention process, with legal hold where an investigation exists.
4
Step Three — Close It Out on a Schedule
Offboarding drags when nobody owns the ending. Put dates on it:
Access grants (delegation, shared mailbox membership) are reviewed at 30 days and removed when the handover is complete.
The licence is released only after the retention decision — archive kept, mailbox converted, or mailbox deleted per policy — never before.
The ticket records each action: who instructed it (HR/manager name), what was blocked, reset, delegated and exported, and when grants were removed.
The leaver's PC is then wiped or reimaged through the normal process — its saved credentials, if any, die with the profile, unread.
Run this way, the company keeps every mail it is entitled to, the leaver's personal secrets stay theirs, and the audit trail reads cleanly start to finish.
🔴 The bright line: admin resets and delegation are the company's authority over its own mailbox. Recovering the person's saved password to sign in as them is impersonation with extra steps — even when the intention is a routine handover. Same destination, and only one of the two routes survives an audit.
Watch the Complete Process in the Video
Watch the video with this page open — the authorised-recovery techniques it shows belong on active support cases. For leavers, pair them with this admin-first process and the password on the PC becomes irrelevant.
The leaver is cooperative and offers their password — can we just use it
Politely decline and use delegation instead. Even a volunteered password creates unattributable access and may be reused on their personal accounts. A cooperative leaver can help far better by confirming handovers while IT grants access properly.
We already signed in with a recovered password — what now
Stop, tell your IT lead or management, and document what was accessed and why. Change the account password through the admin center, switch access to delegation, and let the record show the correction. Early honesty is what keeps a process mistake from becoming a trust incident.
How long should a leaver's mailbox be kept
Follow your retention policy; a common pattern is delegation or shared-mailbox access for about 30 days, then archive or export for records and release the licence. Legal, tax or dispute matters can require longer holds — those decisions belong to management and legal, not the technician.
This guide is based on the Technical Anshu video linked above - Stuck on a step? Ask in the video comments - you will get an answer