What happens to Microsoft 365 Backup data when a user leaves?

A departing user’s Microsoft 365 Backup data is handled as part of the tenant’s backup lifecycle, not as an active user account. Existing recovery points may remain available for restoring the user’s mailbox, OneDrive files or other protected data, while new backup activity for that user may stop once the account is disabled, unlicensed or removed. The precise result depends on the tenant’s backup configuration and the service’s treatment of deleted or inactive users.

It is important to distinguish the Microsoft 365 account from the backup copy. Deleting a user, removing a licence or deleting content from the live service does not necessarily erase the corresponding recovery points immediately. Equally, retaining backup data does not keep the user’s account active, preserve their sign-in access or automatically transfer ownership of their files and messages.

A controlled leaver process should establish what the organisation needs to preserve before the account is changed. This normally includes:

• Disabling sign-in and removing the former user’s administrative or delegated permissions.
• Identifying whether the mailbox, OneDrive content or other data must be restored, exported, reassigned or retained for operational or legal reasons.
• Checking that the relevant workload is included in the backup scope and that usable recovery points exist.
• Recording the date and reason for the account change, together with any required retention or investigation hold.
• Confirming when the backup copy should be allowed to expire under the organisation’s policy.

Backup data is not the same as a retention policy, an archive or an eDiscovery hold. A backup is primarily intended to provide recovery from accidental deletion, corruption, malicious activity or other data-loss events. Retention and compliance controls determine how long information must be preserved and whether it must remain searchable or protected from alteration. Organisations with regulatory, contractual or litigation requirements should therefore define how these controls work together rather than relying on backup alone.

Former-user data can also raise ownership and access issues. A manager may need access to business documents, but that does not mean they should be given the former employee’s credentials or unrestricted access to all personal or confidential material. A safer approach is to restore only the required items to an approved location, assign ownership to an appropriate account and retain an audit record of the action. Restoring an entire account or mailbox should be justified because it may reintroduce outdated permissions or sensitive information.

Before permanently deleting a former user, administrators should verify the recovery implications for each relevant workload. In particular, they should check whether:

• the user’s data is still covered by the applicable backup policy;
• the backup service records the user as active, deleted or otherwise recoverable;
• future restore points will continue to be created or whether only existing points remain;
• the organisation has a documented expiry date for the recovery data; and
• restoration can be performed without recreating the former user’s access.

When the retention period ends, recovery points may be removed in line with the configured policy and service rules. At that stage, the organisation may no longer be able to recover the user’s data from Microsoft 365 Backup. For that reason, a leaver procedure should treat account deletion as a change requiring review, rather than assuming that the backup copy will remain available indefinitely.