Last updated: 21 July 2026
An employee leaves, and their mailbox just... sits there. Here's what you're actually on the hook for — retention, licence cost, security risk — and the fastest way to close it out properly instead of letting it pile up.
What's actually at stake
Records you're contractually or legally required to keep don't stop being required just because the person who sent or received them left. Deleting on day one risks losing something you needed on day ninety.
A full mailbox licence keeps billing until someone actively downgrades or removes it. Leaver mailboxes are one of the most common places companies quietly overpay — nobody's using the seat, but nobody's cancelled it either.
An account nobody's watching is exactly the kind of account an attacker wants — unusual activity on it is far less likely to get noticed. This is independent of what you do with the mailbox content, and should happen immediately on departure.
A sane default
Do this on the day they leave, regardless of what you decide about retention — it closes the security gap without touching the content decision.
Free up to 50GB in most Microsoft 365 plans — colleagues can still access what they need, and you stop paying for a licensed seat nobody's using.
Route incoming mail to a manager or team inbox for a set period (30-90 days is typical) so nothing important falls through during handover.
Pick a policy (e.g. archive after 90 days, delete after a year, unless a legal hold applies) and actually apply it — the alternative is leaver mailboxes accumulating for years.
Not usually a good idea. Deleting the account immediately can break inbound mail to that address (it bounces instead of being handled), lose records you may be required to retain, and cut off anyone mid-conversation with that person — customers included. The safer default is to convert it to a shared mailbox or forward it for a set period, then close it out properly once you're sure nothing's still needed.
Yes, if the licence stays assigned. A full mailbox licence continues billing until it's removed or downgraded — converting to a shared mailbox (free up to 50GB in most Microsoft 365 plans) is the usual way to stop paying for a seat nobody's using while keeping the mailbox itself accessible.
There's no single legal answer — it depends on your sector, contract terms, and any active legal holds. What matters operationally is having a consistent policy (e.g. 90 days accessible, then archived or deleted) rather than leaving leaver mailboxes to accumulate indefinitely, which is how companies end up with dozens of forgotten, still-licensed accounts.
An orphaned account nobody's actively monitoring is a soft target — if credentials are ever compromised, there's no one who'd notice unusual activity on it. Disabling sign-in immediately on departure (separate from what you do with the mailbox content) closes that gap without touching retention decisions.
It's manual by default in Microsoft 365 — each mailbox gets converted, forwarded, or archived individually through the admin center or PowerShell. With enough leavers across a year, that adds up to real recurring IT time for a task that doesn't need a person doing it one at a time.
MailBroom's Storage Cleanup applies the same bulk-cleanup tooling to any mailbox IT manages — including leaver accounts — instead of handling each one by hand.