What to do with a former employee's mailbox

The leaver problem in one paragraph

A leaver's mailbox is a business record. It may hold the only copy of a customer agreement, the thread behind a complaint, or the evidence in a tribunal claim the leaver brings later. It also holds personal data, about them and about everyone they wrote to, so you cannot simply keep it all for ever either. The aim is to keep the right mail for the right period, make it findable by the right people, and stop paying for an account nobody uses.

Microsoft 365: deleted, inactive and shared mailboxes

Microsoft gives you three main routes for a leaver's Exchange Online mailbox.

Microsoft recommends Microsoft 365 retention policies or labels to create inactive mailboxes. Litigation Hold also works but is an older method, and In-Place Holds are retired. If an inactive mailbox was created only by an eDiscovery case hold, releasing the hold or closing the case permanently deletes it. Our Office 365 email archiving page covers the native retention options in more depth.

Google Workspace: deletion and archived users

Google Workspace is less forgiving. Google's own Vault documentation says: "If you delete a user or a required license, their data might be irreversibly purged and no longer available to Vault." Deleting a leaver's account before their mail is preserved elsewhere can lose it.

Google's own route for leavers is to archive the user account, which needs an Archived User licence: the leaver can no longer sign in, Google keeps their data, and Vault retention rules and holds apply where the licence includes Vault. We mention it so you know it exists; we do not sell Google licences, and whether it suits you is a matter for your Google Workspace supplier.

The archive route below works with your existing Google Workspace account without changing your Google licensing. See Google Workspace email archiving and Google Vault vs a separate email archive.

The archive route: keeping leavers' mail without the licence

A separate archive changes the order of events. With NinjaOne Archiver, journaling has been copying every message the leaver sent and received since it was switched on, and the mail already in their mailbox was backed up when it was added. That copy is held by NinjaOne outside your tenant under your retention policy, and on the Archiver plan NinjaOne only lets you deactivate an archive mailbox, not delete it.

When the leaver goes:

• Their archived mail stays searchable through eDiscovery and restorable by administrators
• The archive mailbox is deactivated: it archives no new mail, only administrators can reach it, and it can be reactivated if needed
• Retention runs from each message's received date, under the policy that applies to that user, department or domain
• A legal hold can still be applied if a dispute arises after they leave

NinjaOne's help centre says 20% of purchased seats can be deactivated without using a licence; for example, 2 of 10 seats. How your leavers count towards seats and how long their mail is kept are confirmed when we quote, so the numbers fit your staff turnover. The detail of each status is on deactivated and inactive mailboxes in NinjaOne SaaS Backup.

One condition applies everywhere: only mail captured before the account goes can be kept. NinjaOne says that when a mailbox is deleted from the mail server its backup is deactivated automatically, and that a deactivated mailbox's previously backed-up data is retained.

A leaver checklist for admins

A sequence that works on either platform:

1. Ask HR or legal whether the leaver is involved in a dispute, grievance, investigation or regulated activity that needs a hold or a longer retention period
2. Confirm the mailbox is captured: in the archive, or under a Microsoft 365 retention policy or hold you have checked is applied
3. Block sign-in and reset credentials, so the leaver cannot reach mail after their last day
4. Decide who needs access to ongoing mail, such as a manager covering their customers, and set up forwarding or delegated access for a limited time
5. Give access to past mail through roles and searches, not by sharing the leaver's password
6. Remove the licence or account in line with your process, and deactivate the archive mailbox if it was not deactivated automatically
7. Record what you did and when, and let the retention policy govern deletion

Put the steps in your email retention policy and your leaver process, so they happen the same way every time.

Access, privacy and HR points

Opening a former colleague's mail is sensitive. Some points to build into your process:

• Tell staff in your policies that business email is retained and may be reviewed after they leave
• Give access for a stated purpose, such as covering customers or handling a request, and for a limited time
• Keep searches within compliance roles, so they are logged and IT staff are not reading colleagues' mail
• Treat personal messages in a leaver's mailbox with care, and involve HR or your data protection lead where they turn up
• Remember that a former employee may make a subject access request covering their own mailbox
• Delete leavers' mail when the retention period ends, unless a hold applies; see email retention and UK GDPR

This is general information, not legal or employment advice.

How Forever Systems helps

We can set up NinjaOne Archiver so that leavers become a routine step: journaling capturing mail from the start, retention policies by department or user, compliance roles for HR and legal, and a leaver process your administrators can follow. Where leavers' old mail already sits in PST files, we can help bring it into the archive through email archive migration.

Contact us to talk about keeping former employees' mail without keeping their licences. Pricing depends on users, bundle and leavers: ask us for a quote.