When someone leaves, their mailbox, OneDrive and flows run on different clocks
The leaver ticket usually closes in a day. What the person leaves behind in Microsoft 365 keeps going for weeks after that, on three separate clocks, and none of them waits for the records owner to catch up.
The operating decision is about order. Retention has to be confirmed, and automations handed over, before the account is deleted, because deleting the account is what starts every one of those clocks.
The mailbox: 30 days, unless retention got there first
Delete a Microsoft 365 account and its mailbox data is kept for 30 days, then permanently removed. If a hold or retention setting already applies when the account is deleted, the mailbox becomes an inactive mailbox and is kept for as long as that setting requires.
Learn is specific here, and each point is easy to miss under deadline:
Use Microsoft 365 retention, not an eDiscovery case hold. When a case closes or its hold is released, an inactive mailbox held only by that case is permanently deleted.
The retention setting has to retain, or retain and then delete. A delete-only setting won't make the mailbox inactive. An Exchange MRM retention policy won't either.
Confirm the hold has actually applied, using PowerShell, before deleting the account.
Don't change the user principal name or primary SMTP address first. If you do, you may not be able to delete the inactive mailbox later when you no longer need it.
Adaptive policy scopes can target inactive mailboxes on purpose, so former employees can carry a different retention period from current staff. That decision belongs to the records owner and counsel, in writing, not to whoever is processing the ticket that afternoon.
The OneDrive: a manager, a window and a recycle bin
OneDrive cleanup starts only when the account is deleted from Microsoft Entra ID. Blocking sign-in doesn't start it. Removing the license doesn't either.
When it starts, the user's manager is given access and an email, provided access delegation is on and a manager is set in Entra. If no manager is set, a secondary owner configured in the SharePoint admin center gets them instead. With neither in place, Learn is blunt: nobody gets access, and nobody is warned that the OneDrive will be deleted.
The default window is 30 days and can be changed with `Set-SPOTenant -OrphanedPersonalSitesRetentionPeriod`. A reminder goes out seven days before the end. After that the OneDrive sits in the site collection recycle bin for 93 days. The recycle bin isn't indexed, so an eDiscovery hold can't find content there. Retention policies and labels override the whole cleanup process in both directions: content can be kept longer, or removed sooner.
Microsoft has also simplified the manager's side. They can filter to shared files, select many at once and move them with "Keep sharing with the same people" ticked, so collaborators keep access at the new location. Lists and Forms don't transfer that way.
Watch one more clock. An unlicensed OneDrive is archived automatically on its 93rd unlicensed day, and Learn warns that after 12 months of unpaid archive storage its data might be deleted regardless of retention settings and holds. Long retention on paper doesn't cover a OneDrive that's been sitting unlicensed for a year.
The flows: they can fail quietly
A Power Automate flow whose owner has left is orphaned, and it can fail when its actions use connections tied to that person's account. An admin can find these in the Power Platform admin center: open the environment, go to Resources > Flows, look for flows with no owner listed, and add a co-owner through Share. For volume, `Get-AdminFlow -CreatedBy` lists everything a given user created.
Solution-aware flows can have their owner changed in place. Non-solution flows can't, because the owner is part of the flow's identity, so they have to be added to a solution or rebuilt from a copy. Ownership by a service principal application user removes the dependency on a person entirely. That suits any flow that writes to a business record, the same category last Friday's environments post moved out of the default environment.
The order we'd hold to
HR sets the leaving date and confirms the manager field in Entra is correct.
The records owner confirms that retention covers the mailbox and OneDrive for the required period. Counsel confirms any holds.
The Exchange administrator verifies the hold has applied. Nobody renames the account.
The Power Platform administrator reassigns the person's flows and the connections they use.
The identity team moves any guests the person sponsored to a new sponsor.
Only then is the account deleted, and the manager works through the OneDrive inside the window.
Microsoft's roadmap lists a Purview capability for this end of the process: deleting the content and containers of departed users' OneDrives and mailboxes at scale (roadmap ID 566527, in development, with preview stated as November CY2026 and general availability as December CY2026). It should make deletion easier to run. It doesn't change who decides what must be kept before deletion happens.
