Someone's leaving. Close the doors behind them.
Old accounts are one of the easiest ways into a business. Here's what to do on someone's last day, so nothing important is lost and nothing is left open.
The short answer
When someone leaves, their accounts should stop working the moment they walk out of the door, and anything the business needs (email, files, logins they knew) should be handed over first. Accounts left open after people leave are one of the most common ways attackers get in. Nobody's watching them, so nobody notices when someone else starts using them.
Most leavers aren't a threat at all. This is about tidying up, not suspicion. But doing it the same way every time means you never have to decide whether someone is "the kind of person" to worry about.
Before their last day
- Agree the timing. Decide exactly when access stops. Usually that's the end of their last day. If someone is leaving on difficult terms, it should be the moment they're told.
- Find out what they have. Which systems do they log into? Accounting, CRM, the bank, supplier portals, social media, the website. If you're not sure, ask them while they're still around to answer.
- Hand over files. Ask them to move anything important out of their personal OneDrive or desktop into a shared folder. It's much easier now than later.
- List the devices. Laptop, phone, tablet, keys, door fobs, security tokens.
On their last day: Microsoft 365
- Block sign-in and reset the password. In the Microsoft 365 admin center, open their user account and block sign-in. Don't delete the account yet, because you'll lose things you might need.
- Sign them out everywhere. Use the option to sign out of all sessions. A password change alone doesn't always kick out phones and apps that are already signed in.
- Remove admin roles and group memberships. Especially anything with admin rights. My guide to checking who has admin access covers where to look.
- Keep their email. Converting the mailbox to a shared mailbox lets a colleague keep reading and replying, usually without paying for a licence. Set an automatic reply saying who to contact instead.
- Keep their files. Give their manager access to their OneDrive and move anything important before the account is removed.
- Then free up the licence. Once the mailbox and files are sorted, remove the licence so you stop paying for it.
Everything outside Microsoft 365
- Other apps. Remove or disable them in every system on your list. Apps that use "Sign in with Microsoft" get easier here, because blocking the Microsoft account blocks those too.
- Shared passwords. Change any password they knew: shared logins, the Wi-Fi, the alarm code. A password manager makes this far easier, because you can see exactly what they had access to.
- The bank and suppliers. If they could approve payments or were a named contact, tell the bank and key suppliers. This also stops anyone using their name to request changes to bank details later.
- Devices. Get every device back. Before handing a laptop or phone to someone else, wipe it properly. If you can't get a device back, and your devices are managed, wipe it remotely.
- Remote access. Remove any VPN accounts or remote access tools set up for them.
A few weeks later
Check nothing has been missed. Look for sign-in attempts on their old account, any forwarding rules sending mail elsewhere, and whether any system still lists them as a user. Then, when you're sure you have everything, delete the account.
Make it a habit
Turn this page into a one-page checklist and use it every time. Cyber Essentials expects you to remove or disable accounts as soon as they're no longer needed, so a written leavers process is a big part of the Cyber Essentials user access control. You can see how ready you are with the free Cyber Essentials readiness check.
If you think a former member of staff is still getting into your systems, treat it as a cyber incident. Don't just change the password. Find out what they've accessed first.
FAQ
Should we delete their account straight away?
No. Block it first, keep the email and files, and delete it once you're sure you have everything. Deleting too soon can lose mail and documents you'll need later.
What if they need to keep using their phone?
If it's their own phone, remove your business email and apps from it. If your phones are managed, you can usually remove just the work data without touching their personal photos and messages.
Do we need to do this for contractors and temps too?
Yes. Anyone with a login should go through the same steps when their work ends. Contractor accounts are some of the most commonly forgotten.
Worried someone still has access?
If a former member of staff may still be getting in, or something's gone missing, I'll help you find out what they can reach and lock it down properly.