The licence/sign-in matrix
| Species | Licence | Sign-in | The catch |
|---|---|---|---|
| User | Required | Yes | — |
| Shared | Free under 50GB, no archive/hold; licensed beyond | Must stay blocked — a shared mailbox with a password is a shadow account (BEC's favourite) | The free-tier limits are the conversion trap |
| Resource | Free similarly | Blocked (but the ACCOUNT exists — CA treatment per the Teams rooms lesson) | CalendarProcessing owns behaviour |
| Inactive | None (a hold keeps it) | Removed | Created ONLY via the correct leaver path |
Conversions and their edges
Set-Mailbox -Type Shared (and back) is instant and licence-relevant: convert-then-unlicense is the standard leaver economy — BUT the order matters (convert FIRST; unlicensing a user mailbox starts a deletion clock), size/hold checks gate the free tier, and the account object remains — disable sign-in explicitly, always.
The leaver flow (the decision tree that matters)
- Team needs the mail addressable? → convert to shared, delegate, disable sign-in, unlicense.
- Preserve for compliance, not live? → apply hold/retention THEN remove licence/delete user → mailbox becomes inactive: unlicensed, eDiscovery-searchable for the hold's life, recoverable or restorable into a new mailbox later.
- Need nothing? → delete; 30-day soft-delete, then gone.
The trap between 1 and 2: holds on a shared-converted mailbox push it into licensed territory; a deleted-without-hold mailbox is unrecoverable after 30 days no matter what legal asks. The flowchart belongs IN the offboarding runbook, not in tribal memory.
What to watch (proofs)
- Shared mailboxes with sign-in enabled: the census join (shared type × Entra account enabled) — should be empty; every row is a finding.
- Free-tier compliance: shared mailboxes over 50GB or holding holds without licences — the audit that pre-empts enforcement questions.
- Inactive inventory: Get-Mailbox -InactiveMailboxOnly — each row maps to a leaver + a hold rationale; unexplained rows are process leaks.
- Soft-deleted watch: the 30-day list (recipient-model concept) as a scheduled report — day-31 requests are certainties.