Access should be disabled the same day the person leaves — ideally at the moment their employment ends. Any delay is a window in which an active, unmonitored account can be misused, and dormant credential misuse is among the slowest breaches to detect.

Disabling blocks sign-in immediately while preserving the account's data; deleting removes it entirely. Best practice is to disable first — cutting off access right away — then reassign the person's email and files before deleting, so nothing important is lost.

Usually yes. Convert the mailbox to a shared or archived mailbox and reassign important files to a manager, so client history and project work stay accessible. This can be done immediately after sign-in is disabled.

Orphaned accounts get breached when their credentials are guessed, phished, reused from another leak, or misused by the former employee. Because no one monitors them, attackers can operate undetected for months — which is why these incidents are among the costliest and slowest to catch.

Yes. Reclaiming unused software licenses during offboarding stops you paying for seats nobody uses, and preventing a single credential-based breach avoids costs far larger than the effort of a checklist.