IT security when staff leave: an offboarding checklist that works

Why offboarding goes wrong

In small businesses, leaving is usually handled by whoever is around. Someone remembers to collect the laptop, but nobody disables the Microsoft 365 account. Or the account is disabled, but the person still has access to the accounting software, the supplier portal and the social media pages through separate logins. Months later, a former employee can still see client files from home without anyone realising.

Most departures are friendly, and the risk is not mainly malice. Leftover accounts are targets for attackers, because nobody watches them and nobody notices odd sign-ins. A forgotten account with an old password is an easy way in. Attackers who buy lists of leaked passwords often try them against Microsoft 365 sign-in pages, and an account whose owner left a year ago is unlikely to raise any alarm when it suddenly signs in from overseas. Licence costs add up too, because many businesses keep paying monthly for accounts nobody uses.

Plan before the last day

As soon as a resignation is confirmed, tell whoever manages IT and agree a date and time for access removal. Ask the departing person's manager to list everything they have access to: systems, shared mailboxes, supplier and bank portals, cloud services, building access and devices. Check that list against what your IT records show, because people often have access nobody remembers granting. Arrange a handover of work files. Anything saved on their desktop or in a personal OneDrive should be moved to a shared location the team can reach, and ownership of important documents or Teams should transfer to someone staying.

On the last day

At the agreed time, block sign-in on their Microsoft 365 account, reset the password, revoke all active sessions and remove their MFA methods. Disable accounts in other systems such as the accounting package, CRM, practice management software and remote access tools. Collect laptops, phones, keys, access cards and security tokens, and wipe or reset devices before reissuing them.

For sudden or difficult departures, do this immediately, ideally while the conversation is happening, so there is no window to download or delete data. Your IT provider should be able to act on short notice when you warn them. Also check personal phones that had work apps installed: with app protection in place, a selective wipe removes company data without touching the person's own photos and messages.

Mailbox and files

Do not delete the account straight away. Convert the mailbox to a shared mailbox or give a manager access, so customer emails are not lost. Set an automatic reply directing people to a new contact. Decide how long the mailbox needs to stay, based on business and legal requirements, and set a reminder to review it. OneDrive files are retained for a period after the account is deleted, but do not rely on that alone. Move anything important to SharePoint or a manager's OneDrive before the account is removed, and confirm it is accessible.

Shared passwords and third parties

Change any shared passwords the person knew: the Wi-Fi password, the alarm code, social media accounts, supplier logins and admin accounts. A business password manager makes this easier, because it shows exactly which shared items the person could see. Check that they are removed as an administrator on domains, the website, Google Business Profile and advertising accounts. Tell key suppliers and clients who dealt with the person, so they know who to contact. This also prevents fraud attempts that use a departed employee's name to change payment details.

Licences and housekeeping

Once the mailbox and files are sorted, remove or reassign the person's Microsoft 365 licence so you stop paying for it. Remove them from distribution lists, Teams channels and security groups. Update your asset register to show where their devices went. Record the date each step was completed. If a question comes up later about who had access when, a dated checklist gives a clear answer.

Make it a repeatable checklist

Turn these steps into a standard checklist and use it every time, including for contractors and temporary staff. Review it once a year, adding any systems you have introduced. If your IT provider handles offboarding, ask them to confirm each step back to you in writing. A good offboarding process pairs naturally with a good onboarding process. If you track what access each person is given when they start, removing it when they leave becomes straightforward.