Onboarding gets attention because a new hire cannot work without a laptop and an email account. Offboarding is easier to skip. Weeks later, a former employee can still read company email on their phone, open shared files from a personal computer or sign in to a supplier portal with a shared password.
Most of the time nothing bad happens. But leftover access is one of the most common findings in our security reviews, and it is simple to prevent with a checklist.
Before the last day
- Agree with the manager who will take over the person's email, files and responsibilities.
- List the systems the person uses: Microsoft 365 or Google Workspace, accounting, CRM, banking, payroll, social media, supplier and vendor portals, domain and website accounts.
- Identify any accounts registered in the person's name or personal email that the business depends on, and move them to a company-owned address.
- Arrange the return of laptops, phones, tablets, keys, access cards and security keys.
On the last day
- Block sign-in to the main account and revoke active sessions, so phones and browsers that are already signed in are logged out too. For a sensitive departure, do this at the moment the person is told.
- Reset the password and remove MFA methods registered to personal devices.
- Remove access to other systems on your list, including VPN, remote desktop, building access and any apps that use separate logins.
- Change shared passwords the person knew, such as Wi-Fi, alarm codes, shared mailboxes or social media accounts. A business password manager makes this much easier.
- Remotely wipe company data from personal phones if they used them for work. With device management in place, you can remove just the company apps and data.
In the following days
- Keep the mailbox. In Microsoft 365, converting the mailbox to a shared mailbox keeps the email accessible to a manager without a paid license in most cases. Set an auto-reply pointing customers to the right contact.
- Move important files out of the person's OneDrive or personal storage before the account is deleted. Deleted accounts are only kept for a limited time.
- Check for forwarding and inbox rules that send mail outside the company.
- Reset returned devices properly before reissuing them, and confirm they have been released from Apple or Microsoft device management locks.
- Remove or reassign licenses so you are not paying for accounts nobody uses.
Make it repeatable
Write this checklist down for your own systems and give HR or the office manager a single way to tell IT when someone is leaving. The same process works in reverse for new starters. If several people manage accounts, keep a simple log of who removed what and when.
Getting help
We handle onboarding and offboarding as part of our managed IT services and set up identity and access management so access can be removed in one place. For a one-off review of who still has access to what, ask about our IT audits and assessments.