The IT checklist for when a staff member leaves

Agree the timing before the last day

The person who knows a resignation is coming is usually the manager or owner, not whoever handles IT. Build a habit where a leaving date triggers an IT request straight away, with the exact time access should end. For a friendly departure that is normally close of business on the last day. For a dismissal or a tense resignation, access should end at the moment the conversation happens, so arrange it in advance and have someone ready to act.

Ask the manager a few questions upfront. Who should receive the person's emails afterwards? Who takes over their files, customer conversations and calendar? Do they have anything on a personal device that belongs to the business? Are they keeping their mobile number, and is that number linked to any business account for verification codes? Answers to these drive most of the steps that follow.

Close the main account properly

In Microsoft 365 or Google Workspace, block sign-in first, then reset the password and sign the user out of all sessions. Blocking alone does not always end a session that is already open on a phone, which is why the sign-out step matters. Remove their registered authentication methods so an old phone app can't be used to approve a sign-in later.

Do not delete the account on day one. Deleting it can remove the mailbox and OneDrive after a retention window, and you may need those files months later for a customer query or an employment dispute. A common approach is to convert the mailbox to a shared mailbox, give the manager access, and set an automatic reply that points senders to the right person. Check current licensing rules for shared mailboxes before you remove the licence, as they change from time to time.

Every other system

This is where small businesses usually fall down. The leaver had a login to Xero, the bank portal, the courier booking site, the supplier ordering portal, the website editor, the social media accounts and possibly a dozen cloud tools someone signed up for with a credit card. Each one has its own user list. If you don't have a register of these systems, the leaver's own browser history and saved passwords are a rough guide, but a register is far better.

For each system, remove the user or transfer ownership. Pay special attention to any account where the leaver was the only admin, or where the account was registered to their email address. Those need ownership moved to a business address before access is removed, or you can lock yourself out. Change any shared passwords they knew, such as the Wi-Fi key, alarm code or a shared supplier login.

Devices, phones and keys

Collect the laptop, charger, phone, security keys, door cards and any external drives. Note their condition and check them off against your asset register. If the person used a personal phone with business email or Teams, remove the business data through your device management tool so you only wipe the work profile, not their family photos. Agree this in writing at the start of employment and it is a routine step rather than an awkward one.

Before reissuing a returned laptop, check for files saved locally that never synced, then wipe and reinstall it. If the business phone number moves to another staff member, remember that verification codes for some services may have been going to it, which can be useful or risky depending on who ends up with the number.

Files, ownership and handover

Files in a leaver's OneDrive or personal Google Drive are business records, but nobody else can easily see them. Before the account is removed, have the manager review what is there and move anything that matters into a shared site or team drive. The same goes for documents the leaver shared with customers: if their account disappears, those sharing links may break, and customers will notice.

Calendar items are easy to miss. Recurring meetings the leaver organised will keep appearing until someone cancels or re-creates them. Teams channels where they were the only owner need a new owner. Distribution lists that send to their address need updating so customer enquiries don't vanish into a shared mailbox nobody checks.

Write it down and check it later

Record what was done and when: sign-in blocked, sessions ended, systems removed, devices returned, mailbox converted. That record is useful if there is ever a question about access after someone left, and it makes the next departure faster because the checklist improves each time. Office IT handles leavers this way for managed clients, but the checklist works just as well run in-house.

Set a reminder for thirty and ninety days later. At thirty days, check that the forwarded email is still useful and nothing important is landing unseen. At ninety days, decide whether the mailbox can be archived and the account cleaned up, and confirm that no licences are still being paid for a person who has gone.