When someone leaves, the paperwork usually gets done. Their accounts often don't. A former employee who can still read company email, open shared files, or log in to a vendor portal is a risk, even if they left on good terms. Their password may be reused somewhere that gets breached.

Plan offboarding before the last day, and do the access steps the day they leave. For a difficult departure, do them while the conversation is happening.

Accounts

  • Disable the main account; don't delete it. Block sign-in to their Microsoft 365 or Google Workspace account and reset the password. Deleting it right away can destroy email and files you still need.
  • Sign them out everywhere. Revoke active sessions so phones and laptops already signed in lose access too.
  • Remove their MFA methods, and take them out of any admin roles.
  • Check other systems: accounting software, payroll, banking, line-of-business apps, vendor and supplier portals, social media, and the website.

Shared passwords

List every shared login they knew, like the Wi-Fi password, alarm code, door codes, or a shared vendor account, and change them. A password manager with shared vaults makes this much easier, because it shows what they had access to.

Email and files

  • Decide where their email goes. Forward it to a manager, or, in Microsoft 365, convert the mailbox to a shared mailbox so a coworker can keep handling customer replies.
  • Set an auto-reply telling senders who to contact instead.
  • Move their files from personal folders to a shared location, so nothing disappears when the account is eventually removed.

Devices

  • Collect company laptops, phones, keys, and badges.
  • Remove company data from personal phones if they used one for work email. Mobile device management can do this without touching their personal photos and apps.
  • Wipe and reset returned devices before giving them to someone else.

Remote access

Remove their VPN or remote desktop access, and any remote support tools installed on their home computer.

Write it down

Keep a short record of what you did and when. Next time, the checklist is ready, and nothing depends on remembering.