Microsoft 365 - What NOT to do when Employees Leave!
ฝัง
- เผยแพร่เมื่อ 31 พ.ค. 2024
- In this episode I take a look at the pitfalls that many organisations fall into when removing employees from Microsoft 365. Do you delete the user? Do you back up the users data, and if you do, for how long? What are the security and compliance best practices that should be followed? These are just some of the questions that I’ll discuss in this practical and thought provoking session. Along with discussion, I’ll also show lots of cool demos as well as providing some best practices along with some tips and tricks.
Visit my site at www.Andymalone.org
Timocodes
00:00 Introduction
02:00 Wait! Don’t just hit the delete button! Deleting & restoring Users, Groups and Teams
09:19 Microsoft Exchange Online Tips & Tricks!
15:10 Microsoft Purview Retention Polices & Data Lifecycle Management
25:00 Microsoft Purview - Legal Hold / Litigation Hold explained!
33:32 Session conclusions - วิทยาศาสตร์และเทคโนโลยี
Your videos and teaching style are better than any other TH-cam channel, Udemy course, or book I've come across yet. Thank you!
Thanks very much Mario that means a lot to me. It’s great to have you on board 👍
Thanks for your detailed and interesting explanations. I always look forward to your new videos. In my daily business as a M365 Engineer it helped me to realize many requirements from our company :) Thanks and best regards from Switzerland.
Thanks so much for your kind comment and I’m delighted that you found my channel useful. And I love Switzerland by the way👍😊
Did I miss it? The rabbit hole went to deep for me on a solid understanding on not what to do when someone leaves the company. One drive to be seems like one of the most important document locations that would be needed to save and or investigate, yet nothing on that. So many nooks and crannies with 365.
Hi Marc you can back up user data by either archiving or by using 3rd party software
Re. For OneDrive you can place a retention policy against the user. If you want to retain all user data you would use the Hold feature. Delete the user and then create a new user and grant the new user full access to the on hold data, then take it off hold. Using this method you can also migrate data from one user to another. Check docs.Microsoft.com for more details. Ps did you also see when. Deleted the comments see you also have an option for another user to be given access to the users data 😀
Also…. When you convert a user to shared mailbox and remove license from user…. It will leave a unlicensed user… you MUST keep that unlicensed user once it’s converted to shared mailbox indefinitely for the lifetime of the shared mailbox as it anchored to the mailbox
Would this then keep a copy of the mailbox that people could have access to, then allow you to free up a license for a new user to come in? EXAMPLE: Joe quits his support role and we hire Jake. I would make Joe's email a shared mailbox then drop Joe's license allowing that license to transfer to Jake and even give Jake access to that shared mailbox.
I can't seem to find a straight answer to this situation anywhere.
@@jamesheigh9565 Joe quits role, you make the Mailbox shared, this removes the need for it to have joes license assigned so once it’s converted fully you can remove Joes license…. The mailbox then exists without a need for a license to be present but whoever you give access to this mailbox… must have exchange online or an office license with exchange online part of it to access (business basic, standard, premium, e1,e3,e5 or exchange online plan 1 or 2 add ons)
Once you assign a user with their own license (which they have for own mailbox anyway) to this shared mailbox… it allows them access to open it.
Just don’t delete the original user which will show as an unlicensed used in your active users as this needs to be present as the anchor
@@jamesheigh9565 it affectively separates the user from the mailbox for this process and makes it standalone without needing a license to work… the requirement is then on the person accessing just to have their own license and that’s all that’s needed… all the mail stays in the mailbox and you can even give users permissions to send from that mailbox still.
If the user returns you can assign a license to the user and convert the shared mailbox back to a user mailbox also.
Hope the info helps
@@RevuitNet Thank you yes super helpful!
Thanks once again!! Amazing channel
Thanks 😊
Very helpful. Thank you
Very welcome and thanks for the comment.
Thank you so much!
Thanks you are doing well, i appreciate
Thank you too
Great video again!
I have always been curious about the difference between a permanent retention policy and a mailbox litigation hold? if I would remove the license from Identity, does the data in the mailbox and all items beneath still get preserved in both cases? also what happens in cases of deleted items in the mailbox. One more point.. Litigation hold is only for EXO mailbox but the retention policy works on all objects like EXO mailbox, SharePoint and OneDrive Library, Teams Etc. so what would be the right choice in which scenario.
As I’ve mentioned in the past, only two things happened to data in Microsoft 365. It’s either deleted, or archived. In the case of litigation, our legal hold your data is retained for a specified amount of time. This could include the deletion of the user account. The data will remain And will allow you to assign it to another user if necessary. Full documentation on this can be found at lauren.microsoft.com.
Great content!
hi andy, thanks for this very informative video. can you plz elaborate on the manager assignment part. how the manager will access the left / deleted user mailbox? thanks in advance
The manager can have access to the users OneDrive and Outlook (with permissions) for up to 30days after the user account is deleted.
Great video, albeit not much related to what the subject said? Subject should be "These are the archival and retention features in Office 365". 😊
Great suggestion!
When you convert a user to a shared mailbox does it automatically strip whatever licenses are assigned to that user?
In this example you converted back to normal mailbox but it did not prompt to add a license.
No. A user needs to be licensed to access a mailbox so if another has shared full access then the mailbox will not be deleted as long as you rename the mailbox. docs.microsoft.com/en-us/exchange/collaboration-exo/shared-mailboxes
Hi folks since I recorded this video Microsoft have made an announcement regarding user deletion workflows which make things better check it out here techcommunity.microsoft.com/t5/microsoft-365-blog/new-guided-workflow-for-deleting-microsoft-365-users/ba-p/222872
Great video! Helped out a ton. Only one critique, the audio in the intro and when titles come on screen is a little to loud compared to the rest of the video’s sound.
Thanks for the tips!
Great video Andy, I normally do a backup of the PST and create a Onedrive link to access and backup Onedrive as well. I now wonder though, will the PST have email older than one year ?
Careful! PST is a stand alone file. Consider using an online archive instead. It’s potentially unlimited storage 😀
Ohh great tip, but let me ask you this now, what do I do with the terminated user account, keep the account for as long as I need the archive ?
@@sastreaj depends n your compliance requirements. Adopt a good data lifecycle plan
Hi Andy, regarding Litigation Hold. If a user leaves the business and their mail box is placed on Litigation Hold and I delete the user (tenant clean up). if the user returns to the business within the hold time frame can the mail boxed be reattached to the user?
Yes, I believe so. And if you check out docs.microsoft.com I’m sure there’s a procedure for this.
Very interesting video and very good explanations , i have a question , i am new in a company and i need to delete users that there not any more with us. I don't know how to find them except from list of employee, there so many. Is it way to make groups by department and then the rest that they don't have department delete them ? Or do you know a better way to do it ?
Without knowing your company. In active users you can use the filters. When you delete a user, you can reassign the users onedrive / email to another user. docs.microsoft.com/en-us/microsoft-365/admin/add-users/delete-a-user?view=o365-worldwide and here techcommunity.microsoft.com/t5/microsoft-365-blog/new-guided-workflow-for-deleting-microsoft-365-users/ba-p/222872
Andy, for the rentention policy - that only applies to deleted content right? Like, if you setup a 1 year retention policy it won't alter anything in OneDrive, SharePoint sites, etc unless the content is deleted by the user, correct? Thanks, great video, thumbs up
No retention policies apply to all content (selected) and is archived even if user departs. There are additional options that you can do including retaining individual items as well :-)
@@AndyMaloneMVP but only for removed users, like not my active people, right?
@@MmMMMac2k9 retention policies are for active content.
in our subscription, our accounts are synced from our AD on prem. in the vent a user, resigns, the ADID is deleted, thus, the O365 account is removed. could we still use the concept of converting the person's mailbox to a shared mailbox so that the manager or the user's team mate can still access needed info on the mailbox?
ensure you have the AD recycle bin switched on.
@@AndyMaloneMVP Thank you on reply!
@@yulithaca3483 If you convert a licensed mailbox to a shared mailbox the Azure identity behind that mailbox remains the same, even when you delete the license . Then once you delete the user account from AD while you have sync enabled to Azure AD, the cloud identity of that user will be removed in the next sync cycle. That will remove the shared mailbox from 365.
@14:07 - does the OneDrive files get converted with the shared mailbox ???
- as in, can the users whom can access that shared mailbox also access that users OneDrive ???
- what if you converted that user into a shared mailbox and then delete his/her account, how do we restore it back to a user account ???
Shared mailboxes have nothing to do with OneDrive they are a standalone exchange online feature. If you wanted to archive a OneDrive you’ll notice in my video that when I deleted the user there was a OneDrive option and you could’ve assigned the permissions to another user to access that users data before it was deleted. The other option would be to place the user on legal hold. The second part of your question was also answered in the video.
One thing to remember is that Shared Mailboxes are an additional complication regarding legal discovery and licensing. It is not like the old days when shared mailboxes were simply free (size based, and some features that need extra licenses these days).
Personally, I prefer Microsoft 365 groups
hello thank you very much do i need the information how to synchronize user and computer from 365 EDCATION A+ TO ACTIVE DIRECTORE AZZURE AD
Hi there, thanks for your comment. I can’t speak for 365 education as I’ve not used it. However, you can watch my video on Azure a D connect. Which will provide you with a good overview of how the sync technology works. Thanks again.
Awesome video😀😀
Glad you enjoyed it
Hello Andy. What is your advice for an IT Pro in Microsoft who left IT for some years and wants to come back quickly. How to start and what schedule you recommend?
What’s your interest? Infrastructure, Microsoft 365, Security, DevOps etc?
@@AndyMaloneMVP I am a ex-certified Microsoft engineer in desktop, server, exchange and security domains with big experience till 2013. And now i have to revise and update my knowledge about whole Microsoft solutions and products. You can say i am interested in the first three options you mentioned.I'd like to hear your thoughts😊
@@ZaherHamiyah if either go for the Microsoft 365 or security tracks. Look at learn.Microsoft.com as well as the get certified and exam videos that I recorded they have good resources. Good luck
Thanks for the videos! They're awesome - Slightly unrelated (but not lol) - Would you have any idea as to why when i go to the import tab under Microsoft 365 within "Data lifecycle management" i get a "500 Internal Server Error" - its driving me nuts! Im logged in as a global admin, with the correct roles assigned...
Have you checked your license? Do you need a premium license for this feature. However, if this is not the case I would submit a support ticket. Best of luck
@Andy Malone MVP thanks Andy, I'll give them a shout, we do have Premium licensing. :)
How can we create an Outlook .*pst data file from the 365 admin portal for the users who have left the company?
This is supported in Exchange Server 2022 but not in Exchange Online, sorry
@@AndyMaloneMVP We can use eDiscovery and export the whole mailbox to .pst.
You can not simply convert to a share mailbox. It leaves q shares mailbox with a owner. This violates licenses. Plus if you are AD synced when you remove fron AD the account deletes You have to legal hold and restore to shared mailbox. Or you can export and restore to shared if you do not have E3.
Thanks for the comment. In my demo I focus on the cloud-based shared mailbox not one that’s interconnected with active directory.
Hi Andy, brilliant content!
I would like to know if you recommend replacing a user by the new employee for the same position or creating a new account and tranfering the data (which one to consider?).
We ran into scenarios where it's a return, replacement, etc. and it's seems there's no clear answer to how to deal with these cases properly.
Thank you :)
Honestly, the easiest way to deal with this is simply lock the users account, rename the user and mailbox, reset the password and ensure the user is licensed correctly. You are good to go 😊
Thank you Andy. Just to be sure, you recommend replacing the employee and giving access to the new one all the content of the previous one, right?
@@rachidabiza it depends on the job role. If this person is a replacement for the old employee and needs direct access to the content, then yes, if not, then it will be a case of sharing the material to a new employee which he will need to create a new account for
@@AndyMaloneMVP Thank you!!!
For litigation hold we need EOP2 license right?
Exchange Plan 2 correct
Awesome
What if I want to delete a user so that they don’t show up on active users but I want to keep their mailbox? If I convert the mailbox and delete the original account, the mailbox also gets deleted.
I have 900+ active users because of this but only 120 employees. We need to keep the mailboxes for 10 years as directed by our legal team. Not sure what to do here /:
This ones easy Marco. Place your account on legal hold, create an archive. Delete the user account. Mailbox will read as inactive. Grant full access permissions to a new licensed employee. Take the mailbox off hold. You're sorted. Details here docs.microsoft.com/en-us/microsoft-365/compliance/recover-an-inactive-mailbox?view=o365-worldwide
very good topic to discus
I’m glad you enjoyed it 👍😊
Thank you master jedi. ;)
May the force be with you 🤪
Thanks it was very useful video, I enjoy a lot. dear Andy malone can you make a video about windows 10 system image how to create system image on network location and restore system from network location with "WBADMIN" I try a lot but it does not work. thanks
Good morning thanks for the kind comment. I’ll be honest with you imaging is not really my thing. there are a number of other TH-cam channels who I’m sure cover this topic, and there is lots of documentation at docs.microsoft.com. The Microsoft course that deals with this is MD 100 and MD 101. I hope this helps and thanks for visiting.
@@AndyMaloneMVP Thanks for response.
Thanks very useful, but what about OneDrive data?
in the Delete screen in Office 365 you can also transfer OneDrive contents to another user. I use this often and then Move that content elsewhere
It's all the same. Retention policies include users, groups Teams, and even individual items. Check out some of my other videos on the subject and you'll see :-)
One thing not mentioned here… if you set a manager for a user…. They can only access the mailbox if the deleted user is still in first stage deletion…. ie the admin has not deleted the user permanently in PS or Azure admin centre…. If you remove it then… it’s gone.
Also if you remove the license, all data is gone after 30 days that have not been separated from a user (such a user mailbox into shared mailbox)
Thanks Ron for making some great points 👍😊
@@AndyMaloneMVP Who’s Ron? 😂 no worries
@@RevuitNet sorry Rich, typo 🤪
Can you please direct me to the documentation that if you delete a user, their Manager will automatically get their mailbox for 30 days
Same question I wanted to ask.
www.reddit.com/r/Office365/comments/braag7/how_do_i_grant_a_manager_access_to_a_users_email/ and here www.vembu.com/blog/how-to-grant-permissions-in-exchange-admin-center/
In Europe you need permission form the user to give somebody else access to his or her mailbox due to GDPR
According to European law, You are partly correct, however this is only true for personal data. Corporate data owned by the company can be protected by having the employee sign terms and conditions of employment along with an acceptable usage policy.
Great content. I had a question, what if you want to get rid of Microsoft 365 and use another platform? Does Microsoft still keeps a copy of all your data?
No not after 90 days.
Thanks and what about onboarding?
Coming shortly😊
@@AndyMaloneMVP Thanks. Adding users to email group and matching email group membership to existing user in some easy way 😀
Yoo I am not doing well in studies but still I am here
Ah you need to focus young padwan :-)
Hope to god they haven't used, PowerBI, PowerAutomate or PowerApps it's worse than finding Exchange servers running as Administrator
Long story short, just do litigation hold for the length of time dictated by data retention policies.
Thanks James
A Microsoft MVP and yet uses Mac OS.
Always🤪
Great video but still does not answer the 1000lb gorilla in the room.
Here is scenario.
We use OneDrive extensively (but as we are on Enterprise E3 this is really maps to Sharepoint). All users have most of their files on OneDrive, with and often share files between many users so that they can collaborate on them live.
What we want to do is when a user leaves the company we want to change the owner of ALL that user's files to another user so that they are never lost. This is very simple in Google GSuite, you can simply move everything to a new user. On O365 there simply seems to be no way to do this.
The best Microsoft support has come up with is to hijack the user's account (login as them) and download the OneDrive. Hijack the new user's account (and upload the files as them), but this breaks all the shares, it is also a real PITA if there are lots of files. Even with this process, we find we still loose files. If the dearly departed employee happened to create a file in a shared SharePoint folder (not their own OneDrive) and we miss it. A year or two later, we realize it simply evaporated. There is a 'retention' setting on OneDrive that we have set out to the max but this does not re-own anything.
I hope I am missing something obvious and there is an easy way to handle this. Please consider a follow-up on OneDrive and how to handle files specifically.
Hi there thanks for the question. Here is an article that I think you’ll find useful docs.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee-step-5?view=o365-worldwide