Someone is leaving the organization

Last updated 2026-10-14 · Written with AI assistance, reviewed by a person

People leave: a happy retirement, a new job, the end of a contract, sometimes a difficult parting. Whatever the reason, the same calm routine protects the organization, and it's fair to the person leaving too. Agree the exact cut-off time, keep the records you need, then check access is really gone from every service. Turning off email alone isn't offboarding.

This works for employees, volunteers, contractors, temps or outside providers whose access is ending. It covers access plus continuity. The owner or HR handles the employment side: the decision, conversations with the person, legal requirements.

Who does what. The owner or HR sets the timing. A manager identifies the work to hand over. Whoever runs IT (a staff member, your IT provider or you) makes the changes, with each app's owner. Follow your retention, privacy plus device rules, and stop before anything destructive if they conflict.

Do this now

Whatever the situation, start here:

Pick the right path from the table below: planned, immediate, suspected misconduct or a change of role.
Set the exact cut-off, with a date, a time, a time zone, plus who approved it. "Friday" or "after the meeting" isn't precise enough for whoever is making account changes.
Name a coordinator, with a backup. Confirm who can approve a change if the timing moves.
Confirm any unexpected or urgent request directly with an authorized owner or HR contact, by phone. A forged email must never trigger someone's account shutdown.
Start the access list (below) now, even for a friendly departure months away.

Choose the right path

Departure	How to handle it
Planned resignation or contract end	Build the access list with the handover in advance. Remove access at the agreed time.
Immediate termination, or access must go now	Coordinate HR, the owner, IT plus building access before the meeting. Carry out the agreed cut-off without waiting for a full handover.
Suspected theft, sabotage or misuse	Involve the owner, legal support plus an incident responder. Preserve evidence, then contain access. Don't wipe devices or delete accounts as routine cleanup.
Moving to a different role	Treat it as an access change: remove the old rights, approve new ones. Don't delete the identity.

For a sensitive departure, control who knows in advance. Device commands, ownership transfers or password resets can send notifications. Time them with HR, so nothing visible happens early.

Before the cut-off

The owner or HR

Record the essentials somewhere restricted: who's leaving, their manager, the type of departure, the approved cut-off.
Decide who takes over customers, projects, approvals, business records.
Check retention rules or legal holds before anything is deleted. If unsure, keep the records, then ask your adviser.
Tell IT about any approved ongoing access, like a former-employee payroll portal. Don't keep the whole work account alive for that.

The manager plus IT: build the access list

Use several sources: the manager's handover notes, your sign-in system's app list, the device inventory, password manager memberships, purchase records, app owners. The person's own list is useful, but it can miss old accounts or ones they set up themselves.

Area	Check
Main account	Microsoft 365 or Google Workspace, directory accounts, aliases, separate admin accounts
Business apps	Accounting, payroll, CRM, ticketing, HR, scheduling, e-signature, payment services
Remote plus admin access	VPN, remote support tools, servers, databases, cloud accounts, device management, backup admin
Shared work	Shared mailboxes, files, shared drives, chat, calendars, project spaces
Things that control the business	Domain registrar, DNS, website hosting, social media, advertising, billing, recovery contacts
Secrets plus integrations	Shared passwords, API keys, SSH keys, app passwords, certificates, scheduled jobs, automations
Outside access	Customer or partner portals, guest accounts, vendor portals, personal accounts invited into company spaces
The office	Wi-Fi password, alarm or door codes, keys, badges, phone extension or voicemail
Money	Company cards, bank or payment approval rights, purchasing accounts
Things they hold	Laptops, phones, security keys, USB drives, paper documents

For each one, record the account name, who owns that system, how access is removed, what should happen, who'll check it. Mark unknowns for follow-up: don't quietly tick them off.

Small organizations, watch these: a social media or bank account whose two-step sign-in codes go to the person's own phone, the office Wi-Fi password everyone knows, the alarm code, the domain registrar account in their personal name. These get missed more than anything else.

The manager identifies the work. IT plus app owners make the changes.

Move essential files into company storage, then give them a new owner. Check private folders plus personal workspaces, not just shared ones.
Hand over customer conversations, recurring meetings, open tasks, approvals, renewals, billing notices.
Replace personal recovery details. Where a company service uses the person's own email or phone for recovery, switch it to an approved company one.
Make sure someone else can run every critical service. For a planned departure, set up and test a replacement admin before the cut-off. For active misuse or an immediate security exit, don't keep dangerous access alive just because it's the only admin: contain it, then use the provider's emergency recovery process with the owner.
Move jobs that run under their account (scheduled tasks, integrations, automations) to an approved service account with an owner. Test them.

The new person uses their own account, with delegated access. Never give them the former employee's password, or let them work as that person.

Check it worked: the new owner opens a real file, handles a test approval, or runs the moved process. A changed "owner" field isn't enough if the work still depends on the old account.

Know how each app behaves before you remove access. Removing an app assignment or a group can trigger automatic deletion, license removal or data loss. Keep what you need, then use disable or suspend where available. If time is short, block sign-in plus sessions with a non-destructive control while the app owner sorts out retention. The handover must not turn into open-ended access for someone who's left.

At the cut-off

Whoever runs IT, with app owners:

Block the main account. Block any separate admin accounts too. If accounts sync from another directory, block at the source, then confirm the result.
Revoke active sessions. Revoke relevant tokens too. A disabled account can stop new sign-ins while existing sessions carry on. Check apps that manage their own sessions. [1]
Remove access the main account doesn't control. Local logins, app sessions, guest access. Confirm automatic deprovisioning actually finished.
Revoke keys plus remote access. VPN, remote support accounts, SSH keys, API tokens, app passwords, certificates. Deal with passkeys, recovery methods, backup codes on company accounts that continue. Keep evidence before deleting entries.
Remove memberships plus delegated rights. Password manager vaults, shared mailboxes, groups, cloud roles, outside workspaces.
Change shared secrets they could remember. Shared passwords, the Wi-Fi password, alarm or door codes. Removing them from a vault doesn't make them forget a copied password.
Turn off building access, then collect equipment. Record what came back by asset or serial number.

Rotate shared secrets in order of risk: admin access plus sensitive systems first. If something can't be done right away, record a stop-gap, an owner, a short deadline. Never leave a known gap open without an explicit decision.

Removing access can affect someone's whole working day. Let HR or the owner do the explaining; IT confirms what was done, plus any failures, through the agreed channel.

Microsoft 365

Follow Microsoft's former employee guide to block access, keep business content, arrange email handling, then decide on licensing plus eventual deletion. Hybrid accounts are handled in the on-premises directory.

Converting the mailbox to a shared mailbox doesn't secure the old account: block sign-in, then revoke sessions separately. Keep the underlying account the shared mailbox needs. Check size, archive, retention plus hold licensing before removing a license. [3]

Give approved people access to the OneDrive plus mailbox content, then confirm they can find what they need. Retention differs by service plus configuration: don't assume one deletion window covers everything. [4]

Don't remove licenses just to cut off access. First settle how records will be kept, plus whether that arrangement still needs a license.

Google Workspace

Use the suspend or archive option that fits your edition. Suspension keeps the data, but blocks new email plus calendar invitations, so plan how customer mail will be handled. [5]

Transfer the company data you need, then confirm each app's data is preserved before any deletion. A Drive ownership transfer doesn't preserve Gmail, calendars or other services. Deleting a user can affect Vault retention or holds: never delete a held account, or remove a hold, just to finish a checklist. [6]

Archived user licenses can keep a former employee's data while blocking access, depending on your subscription. [7] Teams on email-verified Essentials work differently: read Google's Essentials removal guidance, including what happens to shared files, before you start.

The mailbox, plus customer contact

The manager or owner approves. IT sets it up.

Decide who needs the correspondence, for what, for how long. Use delegated access, a shared mailbox or another supported method.

Don't forward everything to a manager by default. The mailbox may hold confidential HR, financial or personal email. Limit access to the business need, then review it on a set date.

If customers need a new contact, set up an auto-reply or routing that clearly names the right person or team. Test it from an outside address. Don't keep sending email as though the person still works there.

Check existing forwarding plus delegation, so nothing still reaches the former employee's personal address. Set a date to review or retire temporary forwarding, delegates or the old address.

Devices

IT with the asset owner:

Record what came back, plus what's missing. For remote staff, send a prepaid, tracked return label, then keep the receipt.
Keep required records before any reset. With a legal hold or suspected misconduct, follow the preservation plan before touching the device.
Keep device management records until any remote actions plus evidence collection are done.
Personal devices: remove managed work data within your agreement plus supported controls. Don't assume you can erase someone's whole personal device.
Not returned? Use A work laptop is lost or stolen as needed. A queued wipe isn't proof of erasure.

Disabling the account doesn't erase local downloads, or necessarily stop an offline sign-in on the laptop. Treat the device plus the account as separate jobs. Company data already copied elsewhere may need HR or legal follow-up: IT can't guarantee getting it back.

Check sharing: files shared directly with personal or outside accounts, plus "anyone with the link" shares. Remove or restrict what shouldn't be there, while keeping approved customer collaboration. Moving file ownership doesn't remove old sharing permissions. Move company card, banking plus purchasing authority through each provider, not just by closing the email account.

Check it actually worked

The coordinator collects evidence from each system owner. Don't tick a box just because a request was sent.

Check	Good evidence
Main plus admin accounts	Disabled status, time, completed session revocation
Key business apps	Disabled user, revoked sessions, deprovisioning logs where available
Shared plus admin credentials	Rotation record, a successful test of whatever depends on them, old access gone
Guest plus partner access	Confirmation from whoever controls it
Business records	The new custodian can reach them; where they're kept plus the retention rule are recorded
Automated work	Jobs plus integrations run under the approved replacement account
Equipment plus building access	Asset receipt, or a plan for what's outstanding; badge or key action recorded
Email continuity	The approved person receives a test message; the old account still can't sign in

Review sign-ins after the cut-off, then investigate any successful access. Failed attempts can come from old devices or scheduled jobs: they aren't automatically malicious. Missing logs mean you can't fully verify, not that access is impossible.

Never sign in as the former employee to test. Use admin status, audit records, approved tests with the system owner.

If an app can't revoke sessions, ask its owner or provider for a stop-gap, then record how long existing sessions last. Check again at the cut-off, after the session or sync window, then the next business day. Treat any late removal as an exception with an owner plus a deadline. Disabling accounts rather than deleting them keeps audit trails, in line with CIS Safeguard 6.2. [9]

Exceptions, plus unfinished work

Coming back as a contractor? Give separately approved, limited, time-bound access with a sponsor. Don't quietly switch the old access back on.

Exception	Record
What's still open	The exact system, account or credential
Why	Why it can't be removed yet
Risk	What's still possible, plus how it's limited
Who	The owner fixing it, the person who approved it
When	Deadline, removal action, evidence needed

Open exceptions mean offboarding isn't finished. Track them like any other task, then escalate missed deadlines to the owner.

Close it now, clean up later

Close the access work once every in-scope access is removed, or covered by an approved, time-limited exception, equipment is accounted for, with the handover checked.

Schedule a later review for records retention, licenses, forwarding, temporary delegates plus account deletion. Check holds plus dependencies again then. Deletion is a later decision, never a substitute for blocking access today.

Keep a restricted record with:

Who left, their accounts, their manager, who approved what.
The approved cut-off, what actually happened when, any timing changes.
The access list, what was done, the evidence it worked.
Who holds the records now, retention decisions, any holds.
Equipment returned, anything outstanding, device actions.
Exceptions with their expiry dates, plus later cleanup tasks.

Never store passwords, private keys or recovery codes in the checklist.

Make the next departure easier

Keep a simple list of your apps plus equipment, with an owner for each.
Put domains, billing plus recovery details on company accounts, never someone's personal one.
Give every important process a backup person, with no unattended automation running on a personal account.
Use the same routine for every departure, including friendly ones and short contracts. Consistency protects the organization, and it treats people fairly.

Sources

Checked October 14, 2026. Product behavior, retention plus licensing vary. Retention plus employee data decisions need your own policies plus advice. This playbook combines official platform guidance with CIS access revocation practice, plus NIST SP 800-61 Rev. 3 for cases involving suspected misconduct. It's documentation-based: it hasn't yet been exercised in a live organization.