For IT teams — the school-leaver offboarding policy template

Most schools have an admissions onboarding process documented to the page. The leaver offboarding process is often a sticky note on a senior technician's desk. This is the starter policy template you can edit, get signed off, and adopt.

It's deliberately short. Long policies don't get followed; short ones do.

---

Microsoft 365 leaver offboarding policy — template

Scope

This policy applies to:

• Students leaving at the natural end of their course (Year 11, Year 13, course completion).
• Students transferring out mid-year.
• Staff leaving on natural cycle (end of academic year) or mid-year.

It does not apply to:

• Account suspensions (suspected compromise, behavioural sanctions).
• Account renames (e.g. legal name changes).
• Long absence (sabbaticals, extended sick leave).

Stage 1: Pre-departure (T-30 days)

For students:

• IT confirms with the school office that the student is leaving on the expected date.
• A leaver-week communication is sent to the student (typically via tutor email) noting:
  • The date their account will be deactivated.
  • The fact that their OneDrive, OneNote, and Outlook data will be permanently deleted within a defined window.
  • The school-provided self-service export tool (e.g. mydocs.school) and how to use it.
  • The soft-delete window (typically 30 days) and that requests for restoration within this window are considered case-by-case.

For staff:

• Line manager confirms departure date with HR and IT.
• IT discusses any departmental hand-over of digital resources with the line manager.
• Staff member is informed of the deactivation timeline and the export options available to them for their own work.

Stage 2: At departure

For students:

• Account remains active through the last formal day of attendance.
• Account remains active through the post-exam window where applicable (typically through results day).

For staff:

• Account remains active through the last working day.
• Optional email forwarder set up to nominated colleague or department address for a defined period (typically 30 days), if requested.

Stage 3: Deactivation (T+0)

• IT disables the account in Entra (formerly Azure AD).
• Sign-in stops working immediately.
• License is released and may be reassigned to incoming cohort.
• Account enters Microsoft 365's standard soft-delete state.
• A confirmation log entry is created.

Stage 4: Soft-delete window (T+0 to T+30)

• Data remains recoverable by tenant admin.
• Restoration requests from former students or staff are considered on a case-by-case basis:
  • Genuine, specific requests (e.g. "I need my A-level coursework for a university interview tomorrow") are typically accommodated where IT has capacity.
  • Generic "can I have my account back" requests are typically declined.
• Restoration involves: reactivate account → former user signs in → completes self-service export → account is re-deactivated. Time cost to IT: approximately 15 minutes per request.

Stage 5: Hard delete (T+30)

• Microsoft 365 permanently removes the account and all associated data.
• No restoration possible after this point — this is a Microsoft architectural constraint, not a school policy.
• Any future enquiry about the data receives a referral to GDPR / SAR processes for institutional records, with a note that curriculum work is not within scope of those processes.

Communication template

Suggested wording for the T-30 student leaver email:

Subject: Take your school work with you before you leave

Your school Microsoft 365 account will be deactivated on or around [DATE]. After that, your account will be soft-deleted for 30 days, then permanently removed.

Before you leave, please download a copy of your work — your OneDrive files, your personal OneNote notebooks, and your class OneNote notebooks. The school provides [mydocs.school / equivalent tool] for this. Sign in at [URL], click Download my Docs, and a zip will appear on your computer.

If you don't act before deactivation, your work will be permanently removed and cannot be recovered. The school is not able to restore deactivated accounts as a matter of routine.

If you have any questions, contact [IT contact / address].

Audit and review

• This policy is reviewed annually by [IT lead] in [month].
• Deactivation logs are retained for [retention period] for audit purposes.
• Restoration request decisions are logged with rationale.

---

How to adopt

1. Copy this template into your own policy document.
2. Replace bracketed placeholders.
3. Decide the soft-delete restoration position — generous, balanced, or restrictive. The default above is "case-by-case for specific requests".
4. Get sign-off from senior leadership and (if applicable) the DPO.
5. Publish in the staff handbook and on the school's IT services page.
6. Test by running a mock deactivation against a test account before adopting in production.

Variations by institution type

Independent schools often have faster deactivation cycles (within 30 days of end of academic year). Adjust the timeline accordingly.

Multi-academy trusts with shared tenants need to clarify whether deactivation is per-school or trust-wide. The policy above assumes per-school.

Sixth-form colleges have a leaver moment that's sharper and more concentrated than schools — most students leave the same week. The policy is otherwise the same.

FE colleges and universities typically have additional considerations: alumni email programmes, research data handling, professional body record retention. The template above doesn't cover those — extend as needed.

Related considerations

• GDPR / data protection: a leaver offboarding policy intersects with data retention. Cross-reference with your school's wider retention schedule. Curriculum work is typically not within the long-retention scope; institutional records (attendance, exam results, safeguarding flags) are.
• Safeguarding: in rare cases, former students are subjects of safeguarding processes that require account preservation beyond the standard window. The policy should acknowledge this exception.
• Subject access requests (SARs): former students retain the right to make SARs after deactivation. The relevant data is in institutional records, not the deactivated M365 account.
• Financial records: independent schools have HMRC retention obligations for fee records that operate separately from M365 deactivation.

On the soft-delete restoration position

The most contested part of this policy is usually the soft-delete restoration position. The trade-off:

• Generous restoration (anyone who asks): reduces leaver complaints and reputation risk, increases IT workload, may set unrealistic expectations.
• Restrictive restoration (no exceptions): minimises IT workload, may generate complaints, may surface as parent / governor escalations.
• Case-by-case (the template default): balances both, but requires a defensible rationale for each decision.

The most reliable way to minimise restoration requests is to make the pre-departure communication unmissable — clear, specific, and accompanied by a self-service export tool. Schools that surface this well typically see under 2% of leavers request restoration; schools that don't sometimes see 10% or more.

Adopt the template, edit honestly

Don't adopt this as-is. Edit it to fit your school's actual capacity, your actual policies, your actual culture. A policy that doesn't reflect what your team will actually do isn't useful.

If you'd like a Word version of the template for editing, email [email protected] and we'll send one.