Wind-downs and transitions
Microsoft 365 after cancellation: grace, disabled and deleted stages explained
By SourceX Editorial · Updated
Short answer
When a Microsoft 365 business subscription ends, the data is not deleted at once. For most offers Microsoft describes an Expired stage of 30 days, a Disabled stage of 90 days when only admins can reach and back up data, then Deleted. Timing varies by purchase channel, so export mailboxes, OneDrive, SharePoint and Teams before expiry.
Key takeaways
- For most offers, Microsoft lists Expired (30 days), Disabled (90 days) and then Deleted, with deletion no later than 180 days after cancellation.
- In the Disabled stage only admins can access and back up data, so plan exports for the active and expired stages.
- Stage lengths vary by plan and purchase channel; confirm them in the admin center and Microsoft's current documentation.
- Retention policies and litigation holds inside the tenant are not a substitute for an export to company-controlled storage.
- Removing user licenses or deleting accounts can start separate deletion clocks for mailboxes and OneDrive.
What happens to Microsoft 365 data when the subscription ends?#
Microsoft 365 data stays in place for a time after a business subscription ends, but access narrows in stages until the data is deleted. Microsoft's documentation describes the sequence as expired, then disabled, then deleted, and the admin center shows which stage a subscription is in.
Microsoft's subscription lifecycle article says that for most business offers a subscription that is not renewed moves to Expired for 30 days, then to Disabled for 90 days, when only admins can access and back up data, and then to Deleted. Data left behind might be deleted after 90 days and will be deleted no later than 180 days after cancellation.
Durations vary by purchase channel, such as an Enterprise agreement, Volume Licensing or a Microsoft Customer Agreement, and Microsoft notes that from February 9, 2026 the Expired stage no longer applies to license-based Microsoft Customer Agreement subscriptions. Check the dates shown in your own admin center rather than a figure copied from an old blog post.
The stage timeline#
The stage timeline below describes what generally changes at each point. Confirm the details for your own tenant, because Microsoft updates its policies and the experience can differ by plan.
Microsoft sends stage warnings to the admin and billing contacts on the account. In a wind-down those addresses often belong to people who have already left, so update them to a monitored mailbox before the subscription is set not to renew.
| Stage | Users | Admins | What to do now |
|---|---|---|---|
| Active, set not to renew | Normal access | Full admin access | Run and verify every export; this is the safest window |
| Expired (30 days for most offers) | Usually still have access | Can usually reactivate or renew | Finish exports and redo anything that failed verification |
| Disabled (90 days for most offers) | No access | Only admins can access and back up data | Use only for recovery, and reactivate if exports are incomplete |
| Deleted (no later than 180 days after cancellation) | No access | Customer data is removed and cannot be restored by reactivating | Nothing inside Microsoft 365; only earlier exports remain |
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
Which data does the subscription hold?#
A Microsoft 365 subscription holds far more than email, and every service follows the subscription's stages. List each one in the export plan so nothing is assumed to be covered by a mailbox export.
Microsoft Dynamics 365 and other business applications on the same tenant have their own subscriptions and lifecycles, so check them separately.
- Exchange Online mailboxes, including shared mailboxes, archive mailboxes and calendars.
- OneDrive accounts, which hold many employees' working files and are easy to forget once people leave.
- SharePoint sites and document libraries, including the libraries behind Teams channels.
- Teams chats and channel messages, whose storage spans mailboxes and SharePoint.
- Planner, Lists, Forms and Loop content that teams used to run their work.
- Power Automate flows and Power Apps that encode business processes.
- The directory: users, groups, licenses and domain configuration.
Export routes to use before the disabled stage#
Export routes differ by service, and the right one depends on the licenses the tenant holds. Use the most complete route available while admins still have full access.
Large tenants can take a long time to export, so start early and track each mailbox and site in an export log. Microsoft states that Purview eDiscovery export packages expire 14 days after they are created, so download each package promptly instead of queuing many exports and collecting them later. Verify by opening sample items from the exported copy, not from the live tenant.
| Data | Common export route | What to check |
|---|---|---|
| Mailboxes | eDiscovery search and export in the Microsoft Purview portal, or mailbox export to PST | Archive mailboxes, shared mailboxes and calendars are included |
| OneDrive | Download or copy to company storage, or a migration tool | Departed users' accounts, not only current staff |
| SharePoint and Teams files | Library downloads, sync or a migration tool | Version history and permissions you want a record of |
| Teams chats and channel messages | eDiscovery search and export | Private and shared channels and one-to-one chats |
| Directory | User and group lists exported from the admin center | A mapping of accounts to roles for later privacy preparation |
Who keeps admin access through the stages?#
Admin access through the stages depends on accounts that are easy to lose during layoffs. A global administrator account tied to a departing employee, or protected by multifactor authentication on that person's personal phone, can lock the company out of its own tenant just when exports are running.
Settle access before anyone leaves. The wind-down officer, not the outgoing IT team, should know which accounts can reach the admin center and how to sign in to them.
- Keep at least two global administrator accounts controlled by people who stay through the wind-down.
- Re-register multifactor authentication for those accounts on devices the company controls.
- Review delegated admin relationships with any partner, and confirm what the partner can still do after its own contract ends.
- Store recovery details, the tenant name and the domain registrar login with the wind-down records.
- Record every admin change in the export log so the custody trail stays complete.
Do retention policies and holds protect data after cancellation?#
Retention policies and litigation holds do not protect data once the subscription's data is deleted, because they run inside the tenant that is being removed. They are useful while the subscription is active, for example to stop users or automated rules from deleting content during the wind-down, but they are not an archive.
If counsel has placed a hold, export what the hold covers to company-controlled storage before the subscription lapses and record how it was done. Watch license changes too: removing a user's license or deleting a user account can start its own deletion process for that mailbox and OneDrive, separate from the subscription's stages.
Illustrative: a contract manufacturer closes its tenant in order#
Illustrative: a fictional contract manufacturer of machined parts is closing after its largest customer moves production elsewhere. Its quality team kept NCRs and CAPA reports in SharePoint, customer engineers emailed drawings and deviation requests, and production leads coordinated in Teams.
The managed service provider planned to remove licenses as people left. The wind-down officer stopped that, kept licenses on departed users' accounts, and had the provider turn off auto-renew while running eDiscovery exports of mailboxes and Teams chats and copying SharePoint libraries to encrypted drives.
Customer-owned drawings were tagged for exclusion, and the quality records were marked for licensing review in the retention schedule. The exports were verified while the subscription was still active, and the tenant moved through its stages only after the officer signed off.
How SourceX approaches a Microsoft 365 archive#
SourceX approaches a Microsoft 365 archive by separating record families first. Quality, project and process records in SharePoint can be strong candidates, while mailboxes and chats carry a heavy privacy burden and many third-party details. The fit check starts with metadata, such as services used and years covered, and no files are shared.
If a package proceeds, the Preparation step of the SourceX five-step transaction removes personal and confidential details, customer-owned designs stay out, and the SourceX Evidence Packet records provenance and release authorization. Large archives remain in the company's own storage or ship on encrypted drives.
Frequently asked questions
Can we reactivate a subscription after it expires?
In the Expired and Disabled stages an admin can usually reactivate or renew, which restores access while the data still exists. Microsoft's privacy documentation describes a 90-day limited-function period for extracting data and deletion of all data no more than 180 days after the subscription ends. After deletion, reactivation will not bring data back.
Does buying through a partner change the stages?
It can. Subscriptions bought through a cloud solution provider or under a volume agreement may follow different timing and may be managed by the partner. Ask the partner in writing how and when your subscription will move through each stage, and confirm who holds admin rights.
Should we keep a few licenses active for the custodian?
Keeping a small number of licenses active until exports are verified is often the simplest way to preserve admin access and avoid triggering per-user deletion. Once exports are verified and the retention schedule is set, the subscription can be allowed to end.
What about our domain and email addresses?
The domain registration is separate from Microsoft 365. Keep it renewed through the wind-down so notices from customers, vendors and authorities can still reach the company, and so nobody else can register the domain and receive mail sent to former addresses.
Can Microsoft 365 data be licensed after a company closes?
Some of it may be, after rights and privacy review. Documents such as quality, project and process records are often more suitable than mailboxes, which mix personal, customer and confidential details. Counsel assesses permissions deal by deal, and customer-owned material is excluded.
Sources
- For most offers the lifecycle runs Active, Expired (30 days), Disabled (90 days, only admins can access and back up data), then Deleted; data might be deleted after 90 days and will be deleted no later than 180 days after cancellation. Durations vary by purchase channel. Source
- Purview eDiscovery search exports expire 14 days after creation. Source
- When a subscription ends, Microsoft keeps customer data in a limited-function account for 90 days for extraction and deletes all data no more than 180 days after the subscription ends. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.