Clean up after leavers
Microsoft 365 
Entra ID 
Teams 
SharePoint 
OneDrive 
Copilot AI summary
When employees leave your organization, disabled accounts may retain licenses, Teams and SharePoint sites lose their owners, and OneDrives of disabled users are left behind. Rencore Governance provides policy templates across Microsoft 365, Teams, SharePoint, OneDrive, Entra ID, and Copilot to identify what needs to be cleaned up. You can then remove access, assign new owners, and free up licenses.
Find and remove what leavers leave behind. Policies flag disabled accounts that still hold licenses, Teams and sites whose owner is disabled, and OneDrives of disabled users.
Who it is for: IT operations, HR and the security team, and the collaboration team that looks after TeamsMicrosoft TeamsMicrosoft Teams is the Microsoft 365 app for chat, meetings and team collaboration.Read more and sites.
Steps
- Find the leavers’ footprint. Turn on the disabled-account policies below: create a policy from a template. For one person, create a report from a template, for example who has access to what for one user.
- Get new owners in place for the Teams and sites they owned. See Keep every workspace owned.
- Tell the remaining owners, or remove the access. Create an automation from a template triggered on the violation.
- Find the licenses they still hold. See Reduce license and AI spend.
- Cover people who change roles with a scheduled review.
Step by step: Clean Up After a Leaver.
Policy templates
- Microsoft 365 policies: Disabled user accounts, Disabled user accounts with assigned licenses, Licenses assigned to disabled users, Groups with disabled user accounts.
- Teams policies: Teams with a disabled owner account, Teams with only disabled owner accounts.
- SharePoint policies: SharePoint site collections with disabled owners accounts.
- OneDrive policies: OneDrive belongs to a disabled user account, OneDrive contains files from disabled user accounts.
- Entra ID policies: Devices with disabled user accounts.
- Copilot policies: Copilot License Assigned to Disabled Account.
Limits
- Removing a user’s direct access does not remove access they have through a group.
- Rencore Governance cannot set a manager on an account.
- Reviews of people who change roles cover Microsoft 365 groupsMicrosoft 365 groupA Microsoft 365 Group is the membership object behind many Microsoft 365 workspaces.Read more, Teams, Viva Engage communitiesViva Engage communityA Viva Engage community is a group in Viva Engage where people share posts, files and events around a team, project or interest.Read more and SharePoint sites only.
Frequently asked questions
Which policy templates find Teams whose owner account is disabled?
Which policy templates find Teams whose owner account is disabled?Rencore Governance has two Teams policy templates for this: Teams with a disabled owner account and Teams with only disabled owner accounts. For sites, use SharePoint site collections with disabled owners accounts.
Does removing a leaver's direct access also remove access they get through a group?
No. Removing a user's direct access does not remove access the user has through a group. Group-based access has to be handled separately.
Which items do reviews of people who change roles cover?
Reviews of people who change roles cover Microsoft 365 groups, Teams, Viva Engage communities and SharePoint sites only. Other item types are not part of these scheduled reviews.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?