Employee Offboarding: What to Do With IT Access When Someone Leaves

Employee offboarding is easy to get wrong because the visible parts are not the risky parts. Returning the laptop is obvious. The harder question is whether the person can still reach email, Microsoft 365, cloud storage, practice-management systems, SaaS tools, shared passwords or client data after they have left.

The cleanest offboarding process starts before anyone resigns. If accounts, devices and software are centrally managed from onboarding onwards, a departure becomes a checklist. If staff have been allowed to create their own software accounts, use shared logins or work from unmanaged personal devices, offboarding becomes an investigation.

Start with a complete access list

Before the person's final day, build a list of every system they can access. That normally includes Microsoft 365, line-of-business applications, accounting software, cloud storage, CRM and project tools, remote-access platforms, social media administration, password managers, shared mailboxes and any SaaS product the person signed up for directly.

This is where so-called zombie accounts appear: legitimate accounts that remain active after the employee has left. They are easy to miss because they do not look malicious. The access was originally approved; nobody remembered to remove it.

Do not rely only on the IT provider's known application list. Check recurring software charges, browser bookmarks, identity-provider application lists and the departing person's handover. Shadow SaaS often sits outside the formal IT inventory.

Disable identity first, then clean up the applications behind it

On the agreed departure date, the person's primary business identity should be disabled promptly. For a Microsoft 365 environment that generally means blocking sign-in, ending active sessions, reviewing authentication methods and handling mailbox/data ownership according to the business's retention and handover requirements.

That does not automatically solve every application. Some SaaS products have their own accounts, guest access or shared links. Work through the application list and remove or transfer those separately.

If the person had privileged or administrative rights, treat those as a separate checklist. Administrative access should never survive because somebody remembered to remove the ordinary user account but forgot an older admin identity.

Deal with email and business information deliberately

Email should not simply disappear with the staff member. Decide who needs access to ongoing client correspondence, whether the mailbox should become shared for a period, and how new messages will be handled. The right answer depends on the person's role and the business's retention obligations.

Do the same for OneDrive, SharePoint, Teams and line-of-business data. Transfer ownership where required rather than leaving important information tied to an account that nobody can use.

Recover and manage devices

Company-owned laptops, phones, security keys and other equipment should be recorded and recovered. Once returned, remove the former user from the device and prepare it for reassignment or secure disposal.

Personal devices are harder. If staff were allowed to access company information from unmanaged personal hardware, you may not be able to remotely remove everything that was downloaded locally. That is one reason device-management and BYOD rules should be decided at onboarding, not improvised at resignation.

Change shared access that should never have been shared

If the departing employee knew a shared password, assume it needs to change. Better still, use the departure as the trigger to remove the shared-login model altogether where individual accounts are available.

Shared credentials make offboarding unnecessarily difficult because removing one person's access means changing the secret for everybody. Individual identities, role-based access and a business password manager make the process cleaner and leave a better audit trail.

Do the handover before the final day

A good offboarding checklist includes business knowledge as well as technology. Record the systems the person owns, recurring tasks, important client threads, supplier relationships and any automation or process that only they understand.

If that information is documented continuously, offboarding is straightforward. If it lives entirely in one person's head and inbox, the departure creates an operational problem as well as a security one.

What a reasonable offboarding checklist looks like

• Confirm the person's final working date and the exact time access should end.
• List business systems, SaaS applications, shared mailboxes, groups and administrative roles.
• Block sign-in and revoke active sessions at the agreed time.
• Remove or transfer access in third-party applications.
• Transfer mailbox, files and client information where required.
• Recover company devices and security keys.
• Change shared credentials the person knew.
• Remove building, VPN, remote-access and other physical/digital access.
• Confirm handover of recurring work and system ownership.
• Check for remaining accounts or licences after the departure.

The best test is simple: if this person left unexpectedly tomorrow, could you identify every system they can access without asking them?

If the answer is no, fix the inventory and onboarding process before the next resignation. Our IT Security Self-Check covers identity and access as part of the wider security baseline, and our managed IT support includes the lifecycle work around users, devices and access. If you want to review how your current process holds up, book an IT Fit Check.