Rehiring a Former Employee in Microsoft 365: Restore the Old Account, Recreate It, or Start Fresh?

Look in four places, in this order, before promising anything.

1. Entra admin center, Users, Deleted users. A soft-deleted account appears here with its deletion date. Per Microsoft's documentation at the time of writing, a deleted user can be restored for 30 days; after that the object is permanently deleted.
2. Exchange admin center, shared mailboxes. A converted mailbox is here under the old address, with the user object still present and sign-in blocked.
3. Inactive mailboxes. A mailbox on hold or under a Purview retention policy when the user was deleted became an inactive mailbox, listed in the Purview portal.
4. SharePoint admin center, the deleted user's OneDrive. Our refreshed offboarding guide notes it is retained for a configurable period, commonly 30 days by default, and a manager may have access or the files may sit on a team site.

The offboarding ticket is the fifth place: How to offboard former employees in Microsoft 365 and preserve mailbox data sets out the four preservation paths, and whichever was chosen decides which path applies now. Two questions for HR and legal first: is the old mailbox under a hold or investigation, in which case nobody reactivates it without written sign-off; and is this the same role, or one that should not inherit the old access?

When the user object is in Deleted users and inside the window.

Restore it from Deleted users. Per Microsoft's documentation at the time of writing, the restored object keeps its identifier and attributes, and the mailbox and OneDrive return with it if inside their own retention periods. Group memberships are expected to return; verify rather than assume, since any group cleaned up meanwhile is gone.

Licenses do not come back if offboarding removed them before deletion, the usual sequence. Reassign the license or add the account to the licensing group, and the mailbox reconnects; then unblock sign-in.

The trap is the address. Offboarding often adds it as an alias on a colleague's or shared mailbox so customer mail keeps arriving, and while that alias exists the restore cannot reclaim it. Get-Recipient -Filter "EmailAddresses -like '*old.address@yourdomain.com*'" finds it; remove it and decide with the manager who owns the address.

Shared mailbox. The user object exists with sign-in blocked, no license and colleagues holding Full Access. In the Exchange admin center convert it back to a regular mailbox; per Microsoft's documentation at the time of writing the user needs a license for that, so assign it first. Then remove the Full Access, Send As and Send on Behalf permissions granted at offboarding, clear the automatic reply and any forwarding, and unblock sign-in. Warn the colleagues working out of the mailbox; they lose access the moment it becomes personal again, and if the team still needs the address, give them a new shared mailbox and the rehire a new address.

Inactive mailbox. The user object was deleted but a hold kept the mailbox. Per Microsoft's documentation at the time of writing there are two operations: recovering it turns it into the active mailbox of a new user account and the inactive mailbox ceases to exist; restoring it copies the contents into another mailbox and leaves the inactive mailbox in place. For a rehire, recovery is the natural choice unless legal needs the preserved mailbox untouched, in which case restore into a new mailbox. Both are Exchange Online PowerShell operations whose parameters change, so run the current procedure from Microsoft Learn and decide with legal whether the hold stays on.

OneDrive. If still within retention, restore it from the SharePoint admin center and reassign ownership; if the files were copied to a team site at offboarding, point the person there.

When the object is permanently deleted with no inactive mailbox, the person left years ago, or HR wants a clean start.

Create the user as you would any joiner, with the old user principal name and primary address if no alias on a shared mailbox, distribution list or mail contact still holds them. The new object has a new identifier, so anything granted to the old one, app roles, Teams ownership, SharePoint permissions and Conditional Access group memberships, must be granted again, against the new role.

Old data comes back only where retention kept it: a Purview retention policy on the mailbox means a content search or eDiscovery export can retrieve it; a OneDrive past its retention period is gone; Teams chat history from the old account does not transfer.

With HR-driven provisioning a rehire is a matching problem, not a manual one: the design for HR-Driven Joiner-Mover-Leaver Automation with Entra ID includes the matching attribute and rehire handling, so the HR record with the same employee identifier re-creates or re-enables the account by rule.

Treat the returning account as new; its credentials, devices and consents date from a period when nobody was watching it.

• Fresh password, or a Temporary Access Pass where the organization is passwordless.
• Delete every registered MFA method and re-register; the number and device on file may belong to someone else now.
• Revoke sessions and refresh tokens after the reset.
• Remove the account's OAuth consents under Enterprise applications and its stale registered devices in Entra and Intune.
• Check it is not still in a Conditional Access exclusion group and holds no administrator role from its previous life; roles are reassigned against the new job, through PIM where you have Entra ID P2.
• Review inbox rules and forwarding; offboarding may have added forwarding, and idle mailboxes are where attackers leave rules.
• Group memberships against the new role, not the old one; a rehire into a different job is a mover.

Licensing: a restored, recovered or new account needs a license from day one. Under New Commerce a seat added mid-term is prorated while reductions wait for renewal; Microsoft 365 License Cleanup Before Renewal covers the timing. A shared mailbox under Microsoft's size threshold needed no license, so the conversion adds a seat; our Exchange Online plan comparison gives the threshold as 50 GB.

Naming: reuse the old user principal name and primary address whenever available, so external contacts, invitations and mailing lists keep working.

Every difficult rehire traces back to an offboarding that was not written down. Managed Entra ID Identity Hygiene and Access Reviews records stale-account decisions monthly at $3 per user per month, and letting HR drive the directory makes a rehire the same event as a hire: the joiner-mover-leaver automation above for roughly 100 to 1,000 users, or a plain attribute sync, User Synchronization Between Microsoft Entra ID and BambooHR or User Synchronization Between Microsoft Entra ID and Ramp at $1,000 per project. Microsoft Entra ID Governance: Access Reviews, PIM, and Lifecycle Workflows explains the machinery.

How long can a deleted Microsoft 365 user be restored?

Per Microsoft's documentation at the time of writing, 30 days from deletion. The Deleted users view shows the date; after the window, path 3 applies.

Does restoring the user bring the license back?

Not if it was removed before deletion, the usual sequence; reassign it or add the account to the licensing group, and the mailbox reconnects.

The team still uses the old mailbox as a shared mailbox. Can they keep it?

Yes, if the rehire gets a new address; otherwise convert it back and give the team a new shared mailbox. Decide who owns the address first.

Can we get the old Teams chat history back?

Only with the old account, which keeps what retention kept; a new account cannot inherit another account's chats.

Do we really have to reset MFA if the person is the same?

Yes. The methods on file may point at a number or device the person no longer has, or someone else now does; delete them and re-register on day one.

• IT Partner: /blog/how-to-delete-former-employees-microsoft-365-accounts-and-properly-preserve-their-mailbox-data (content/blog/refreshed): the four preservation paths, the shared-mailbox conversion, the OneDrive retention default and the New Commerce note
• IT Partner: /blog/exchange-online-plan-1-vs-plan-2-vs-kiosk-vs-business-basic-mailbox-licensing (content/blog/new): the 50 GB shared-mailbox figure
• IT Partner service pages: /services/hr-driven-joiner-mover-leaver-automation-entra-id, /services/managed-entra-id-identity-hygiene-access-reviews, /services/entra-id-bamboohr-user-sync and /services/entra-id-ramp-user-sync (content/services), including the prices quoted
• IT Partner: /tools/tenant-optimizer (src/app/tools)

Microsoft's documentation on deleted users, shared mailboxes, inactive mailboxes and OneDrive retention was not opened; Microsoft's behavior is stated per its documentation at the time of writing, and PowerShell procedures should be taken from Microsoft Learn.