When someone leaves, the instinct is to 'just delete their account.' Don't — at least not first. Deleting an account too early is how a business loses years of a person's email and files, or leaves a side door quietly open. Offboarding is really a short checklist, and the value is entirely in doing the steps in the right order. Here's the order we use.
1. Lock the account the moment they leave
On their last day, reset the account password and sign out of all its sessions. This immediately stops any further access — from them, or from anyone who might have their laptop — while you work through the rest calmly. Nothing is deleted; it's simply locked.
2. Keep the email — don't delete the mailbox
That mailbox holds client conversations and history you'll want. Rather than delete it, convert it to a shared mailbox: the email stays, anyone who needs to can still see it, and — a nice bonus — a shared mailbox doesn't need a paid licence, so you stop paying for a seat nobody's using. An auto-reply pointing people to the right person is a thoughtful touch too.
3. Reassign their files before anything is removed
A departing person's OneDrive and any files they owned need to be handed to a manager or successor before their account is cleaned up — otherwise those files can vanish with the account. Reassign ownership first; tidy up second.
4. Close every door, not just email
This is the step that's easy to half-finish. People accumulate access to far more than their inbox: the accounting software, the booking system, shared drives, security tools, any app they signed into with a work login. Work down the list and remove each one — leftover access to a line-of-business app is exactly the kind of thing that's forgotten until it becomes a problem.
A quick sweep of the places people commonly still have access:
- Accounting and payroll (QuickBooks, Xero, your bank portal)
- The booking, scheduling, or practice-management system
- Shared drives and any SharePoint or Teams sites
- Security and IT tools (antivirus, password manager, remote access)
- Data-protection and backup services
- Line-of-business apps unique to your trade
- Anything they signed into with a work Google or Microsoft login
- Social media, review sites, and marketing tools
A password manager makes this far easier, because it's a ready-made list of everywhere that person had a login. If you don't keep one yet, an offboarding is a good reminder of why it helps.
5. Reclaim the device
Finally, collect the laptop or phone and either wipe it for the next person or retire it. If work data lived on the device itself, make sure it's removed properly — and take the person off any group email lists so messages don't keep flowing to an empty seat.
Why the order matters so much
Every step here protects something the next one could undo. Lock first, and nobody can quietly copy data while you work. Preserve the mailbox before touching the licence, and you keep the history. Reassign the files before cleanup, and nothing vanishes with the account. Done out of order — especially 'delete first' — you can lose exactly the things you were trying to protect. The order isn't fussiness; it's the whole method.
Make it a repeatable checklist
The businesses that never get burned by a departure are the ones that treat offboarding as a routine, not a scramble. Write the steps down once, keep them somewhere shared, and run the same list every time — for a planned leaver or a sudden one. A password manager doubles as the master list of everywhere access needs pulling, which turns the whole thing from guesswork into a ten-minute job.
Don't forget contractors and shared logins
Two things catch people out. Contractors and freelancers often have logins too, and they're easy to forget because they were never on the payroll — sweep them exactly the same way. And if your team shares any passwords (one login several people use), a departure is the moment to change them, because 'shared' means the leaver still knows them. It's a good nudge toward giving everyone their own account and a password manager, which makes the next departure far simpler.
There's a human side worth a thought too. An amicable leaver will often help — a quick handover of where things live, which clients they looked after, any logins only they knew — so it's worth asking before the account goes quiet. A difficult departure is the opposite: that's exactly when locking access on the last day, not the last week, earns its keep.
If getting all this right under time pressure feels like a lot, that's exactly the sort of thing we run for clients — a calm, same-every-time offboarding so nothing's lost, nothing's left open, and you're not paying for seats nobody uses. It usually takes far less time than the worry it removes.
The offboarding checklist, at a glance
| When | Do this | Why it matters |
|---|---|---|
| On the last day | Reset the password; sign out all sessions | Stops all access instantly |
| On the last day | Set an auto-reply pointing elsewhere | Customers aren't left hanging |
| Within a day | Convert the mailbox to shared; drop the licence | Keeps the email, stops the cost |
| Within a day | Reassign their OneDrive/SharePoint files | Files don't vanish with the account |
| Within a few days | Remove access from every other system | Closes forgotten side doors |
| Within a few days | Collect and wipe the device; clear list memberships | Nothing's left on the hardware |
A quick word on keeping records
Some industries have to retain email and records for a set period, so before anything is permanently deleted it's worth a moment's thought about what you're obliged to keep. Turning the mailbox into a shared one handles most of this quietly — the history stays put and searchable — but if you're in a regulated field, it's a good thing to confirm rather than assume.