Offboarding Checklist: Remove Access When Staff Leave
When someone leaves your business, their logins do not leave with them. Email accounts, shared passwords, social media roles and bank access can stay active for months unless someone deliberately switches them off. This checklist helps you remove access cleanly, keep the files and contacts you need, and protect your business without making a goodbye awkward.
Key takeaways
- Revoke access the same day someone leaves, ideally at the moment their last shift ends.
- Transfer file ownership and handle the mailbox before deleting any account, so client history is not lost.
- Change every shared password the person knew, and remove them from social media, ad accounts, the domain registrar and banking.
- Recover devices, document what you did and use each departure to improve your access records.
In a small business, people often wear many hats, so their access spreads widely. The office manager may hold the domain registrar login, the marketing freelancer may be an admin on the Facebook page, and the bookkeeper may have access to online banking and payroll. When they leave, nobody remembers every system they touched.
Most departures are friendly, and this is not about suspicion. Former staff accounts are a well-known security risk simply because nobody is watching them. A forgotten account with a reused password can become an easy way in for an attacker years later. The platforms mentioned below change their settings and menus often, so check each provider's current documentation for the exact steps.
Before the last day: prepare
Good offboarding starts before the person leaves. A little preparation means that on the final day you are working through a list, not searching for passwords.
- List their access. Write down every system, account and device the person uses. Ask them to help: most people are happy to list what they log in to.
- Plan the handover. Decide who takes over each responsibility, client relationship and shared inbox.
- Collect knowledge. Ask the person to document recurring tasks, key contacts and where important files live.
- Check ownership. Identify files, folders, calendars and accounts that the person personally owns rather than the business.
- Agree the timing. Decide exactly when access will be switched off, usually at the end of their last working day. In a tense departure, do it before or during the exit conversation.
Common mistake
Deleting a departing employee's account immediately to "clean up." In many systems, deleting a user also deletes or orphans their files, emails and calendar events. Suspend or block sign-in first, transfer what you need, then delete later according to your retention plan.
Last day: revoke core access
These are the accounts that matter most. Switch them off the same day, in roughly this order.
Main business account
Start with your Google Workspace or Microsoft 365 account, or whatever your main email and productivity suite is. Because many other services use it for single sign-on (signing in with one company account) or password resets, blocking it closes many doors at once.
- Suspend or block sign-in rather than deleting straight away.
- Sign the user out of all sessions and reset their password, so devices already logged in lose access.
- Remove app passwords and recovery options such as a personal phone number or email used for two-factor authentication on the business account.
- Remove them from groups and shared drives they no longer need, especially admin groups.
Password manager and shared passwords
If you use a business password manager, remove the person from the organization and from shared vaults. Then make a list of every shared password they could see and change them. This is where a password manager with shared vaults pays off: you can see exactly what was shared with whom.
If shared passwords live in a spreadsheet or someone's memory, treat every one of them as known by the departing employee. Change them, and use the exercise as a reason to move to individual accounts wherever the service allows it.
Keep the data: files, email and calendars
Revoking access protects you. Keeping the data protects your relationships with clients. Do both before you delete anything.
Transfer file ownership
In cloud storage, files often belong to the person who created them. If that person's account is deleted, their files may go with it. Use your admin console's data transfer tools to move ownership of files to a manager or a shared account. Better still, store business files in shared drives or team sites owned by the organization, so they never depended on one person.
Handle the mailbox
Clients and suppliers will keep emailing the old address for a while. You have a few options, depending on your platform and your legal obligations:
- Forward new email to a colleague for a set period.
- Convert the mailbox to a shared mailbox that the relevant team can read, where your platform supports it.
- Set an auto-reply explaining that the person has left and who to contact instead.
- Export and archive the mailbox if you need to keep records before deleting the account.
Data protection rules, including GDPR in the EU and UK, affect how long you keep a former employee's mailbox and how you handle personal messages in it. Set a clear retention period and check local requirements with an adviser if you are unsure.
Calendars and recurring meetings
Meetings the person organized may disappear or become uneditable once their account is gone. Transfer or recreate important recurring meetings, such as client check-ins, under a colleague's account.
Pro tip
Use a role address like accounts@, sales@ or support@ for anything customers or suppliers rely on, instead of a person's name. When staff change, you just update who can read the role mailbox, and nobody outside the business notices.
The accounts people forget
The main business account is the easy part. The real risk hides in the long tail of other services. Go through each of these areas and remove or change access.
| Area | What to check |
|---|---|
| Social media | Page and account roles in Meta Business Suite, LinkedIn page admins, logins for other platforms |
| Advertising | Google Ads, Meta ad accounts and any saved payment methods they added |
| Google Business Profile | Owners and managers of your listing |
| Domain and website | Domain registrar, DNS provider, hosting, website admin and the email address used for account recovery |
| Money | Online banking users, payment providers, accounting software, payroll, company cards |
| Operations | CRM, booking system, point of sale, project tools, chat apps, supplier portals |
| Physical access | Keys, alarm codes, door cards, staff Wi-Fi passphrase |
Pay special attention to the domain registrar. If the person registered your domain with their own email address or personal account, transfer it to a business-owned account as a priority. Losing control of your domain can take your website and email offline.
For social media and ad accounts, use the platform's role or partner features rather than shared logins. Remove the person's role, then check whether they were the only admin. Every important account should have at least two business-controlled admins.
Hypothetical example
Imagine a small marketing agency where a long-time account manager leaves on good terms. The owner suspends her email account at 5 p.m. on her last day, transfers her client folders to a shared drive and forwards her email to a colleague for 60 days. A week later, a client mentions that his ad account still lists her as an admin. Checking further, the owner finds three more ad accounts and a scheduling tool she still had access to. The agency adds an "access register" spreadsheet so the next departure takes minutes, not detective work.
Devices and final steps
Recover and wipe devices
Collect company laptops, phones, tablets, security keys and any other equipment. Before reissuing them, back up anything needed, then wipe and reset each device. If you use mobile device management, remove the device from management or wipe it from the dashboard. For personal phones that held work data, remove the work profile or managed apps so business data is deleted.
Document what you did
Write a short record of each step: which accounts were suspended, which passwords changed, who received which files and when devices were returned. This protects you if questions come up later and makes the next offboarding faster. Keep it with your other HR records, following your data retention policy.
Your offboarding checklist
- List every system, account and device the person uses
- Agree handover, timing and who takes over each responsibility
- Suspend the main business account and sign out all sessions
- Remove the person from the password manager and shared vaults
- Change every shared password they could see
- Transfer file ownership and important calendar events
- Forward, convert or archive the mailbox, and set an auto-reply
- Remove social media, ad account and Google Business Profile roles
- Check domain registrar, hosting and website admin access
- Remove banking, payment, payroll and accounting access
- Collect keys, change alarm codes and the staff Wi-Fi passphrase
- Recover, wipe and reset devices, or remove work profiles
- Document every step and update your access register
Frequently asked questions
Should I delete a former employee's email account?
Not immediately. Suspend it, transfer files and handle the mailbox first, then delete it later according to your retention plan. Deleting too early can wipe files and emails that the business still needs.
What about freelancers and contractors?
Treat them the same way. Contractors often get admin access to websites, ad accounts and social media for a project. Remove it when the project ends, and give them their own accounts or roles from the start so removal is simple.
How can I make offboarding easier next time?
Keep an access register that lists who has access to each system, use individual accounts and roles instead of shared logins, store files in shared drives owned by the business, and make sure every critical account has at least two business-controlled admins.
Is it rude to cut off access on someone's last day?
Not if you explain it as standard procedure that applies to everyone. Tell people in advance when access will end, give them time to hand over and to remove any personal files, and thank them for their work. Clear, consistent rules feel fair.
Related reading
The bottom line
Offboarding is one of the simplest ways to close a security gap that many small businesses leave wide open. Revoke access the same day, transfer the files and mailbox before you delete anything, and work through the long tail of social, ad, domain and banking accounts.
Keep a written checklist and an access register, and each departure will be faster and calmer than the last. The goal is simple: when someone leaves your business, their access leaves too.
