Skip to main content

IT Support

Offboarding an employee safely: the IT checklist that leaves no data behind

When someone leaves, cutting their access is only half the job — you also need to keep their email and files, and close every door, not just the obvious one. Here's the order that gets it right.

· 9 min read

When someone leaves, the instinct is to 'just delete their account.' Don't — at least not first. Deleting an account too early is how a business loses years of a person's email and files, or leaves a side door quietly open. Offboarding is really a short checklist, and the value is entirely in doing the steps in the right order. Here's the order we use.

1. Lock the account the moment they leave

On their last day, reset the account password and sign out of all its sessions. This immediately stops any further access — from them, or from anyone who might have their laptop — while you work through the rest calmly. Nothing is deleted; it's simply locked.

2. Keep the email — don't delete the mailbox

That mailbox holds client conversations and history you'll want. Rather than delete it, convert it to a shared mailbox: the email stays, anyone who needs to can still see it, and — a nice bonus — a shared mailbox doesn't need a paid licence, so you stop paying for a seat nobody's using. An auto-reply pointing people to the right person is a thoughtful touch too.

3. Reassign their files before anything is removed

A departing person's OneDrive and any files they owned need to be handed to a manager or successor before their account is cleaned up — otherwise those files can vanish with the account. Reassign ownership first; tidy up second.

4. Close every door, not just email

This is the step that's easy to half-finish. People accumulate access to far more than their inbox: the accounting software, the booking system, shared drives, security tools, any app they signed into with a work login. Work down the list and remove each one — leftover access to a line-of-business app is exactly the kind of thing that's forgotten until it becomes a problem.

A quick sweep of the places people commonly still have access:

  • Accounting and payroll (QuickBooks, Xero, your bank portal)
  • The booking, scheduling, or practice-management system
  • Shared drives and any SharePoint or Teams sites
  • Security and IT tools (antivirus, password manager, remote access)
  • Data-protection and backup services
  • Line-of-business apps unique to your trade
  • Anything they signed into with a work Google or Microsoft login
  • Social media, review sites, and marketing tools

A password manager makes this far easier, because it's a ready-made list of everywhere that person had a login. If you don't keep one yet, an offboarding is a good reminder of why it helps.

5. Reclaim the device

Finally, collect the laptop or phone and either wipe it for the next person or retire it. If work data lived on the device itself, make sure it's removed properly — and take the person off any group email lists so messages don't keep flowing to an empty seat.

Why the order matters so much

Every step here protects something the next one could undo. Lock first, and nobody can quietly copy data while you work. Preserve the mailbox before touching the licence, and you keep the history. Reassign the files before cleanup, and nothing vanishes with the account. Done out of order — especially 'delete first' — you can lose exactly the things you were trying to protect. The order isn't fussiness; it's the whole method.

Make it a repeatable checklist

The businesses that never get burned by a departure are the ones that treat offboarding as a routine, not a scramble. Write the steps down once, keep them somewhere shared, and run the same list every time — for a planned leaver or a sudden one. A password manager doubles as the master list of everywhere access needs pulling, which turns the whole thing from guesswork into a ten-minute job.

Don't forget contractors and shared logins

Two things catch people out. Contractors and freelancers often have logins too, and they're easy to forget because they were never on the payroll — sweep them exactly the same way. And if your team shares any passwords (one login several people use), a departure is the moment to change them, because 'shared' means the leaver still knows them. It's a good nudge toward giving everyone their own account and a password manager, which makes the next departure far simpler.

There's a human side worth a thought too. An amicable leaver will often help — a quick handover of where things live, which clients they looked after, any logins only they knew — so it's worth asking before the account goes quiet. A difficult departure is the opposite: that's exactly when locking access on the last day, not the last week, earns its keep.

If getting all this right under time pressure feels like a lot, that's exactly the sort of thing we run for clients — a calm, same-every-time offboarding so nothing's lost, nothing's left open, and you're not paying for seats nobody uses. It usually takes far less time than the worry it removes.

The offboarding checklist, at a glance

WhenDo thisWhy it matters
On the last dayReset the password; sign out all sessionsStops all access instantly
On the last daySet an auto-reply pointing elsewhereCustomers aren't left hanging
Within a dayConvert the mailbox to shared; drop the licenceKeeps the email, stops the cost
Within a dayReassign their OneDrive/SharePoint filesFiles don't vanish with the account
Within a few daysRemove access from every other systemCloses forgotten side doors
Within a few daysCollect and wipe the device; clear list membershipsNothing's left on the hardware

A quick word on keeping records

Some industries have to retain email and records for a set period, so before anything is permanently deleted it's worth a moment's thought about what you're obliged to keep. Turning the mailbox into a shared one handles most of this quietly — the history stays put and searchable — but if you're in a regulated field, it's a good thing to confirm rather than assume.

Frequently asked questions

Can I keep a former employee's emails after they leave?
Yes — instead of deleting the mailbox, convert it to a shared mailbox. The email and history are preserved, colleagues who need access can still see it, and a shared mailbox doesn't require a paid licence, so you stop paying for the seat.
Do I still pay for their Microsoft 365 licence after they go?
Only if you leave the account as-is. Once you've preserved the mailbox as a shared mailbox and reassigned their files, you can free up — and stop paying for — the licence.
What happens to their files if I just delete the account?
They can be lost. A departing person's OneDrive files are tied to their account, so you should reassign ownership to a manager or successor before the account is removed — otherwise the files may be deleted along with it.
How quickly should we cut access when someone leaves?
The password reset and sign-out should happen on their last day — that's the step that stops all access immediately. The rest (preserving the mailbox, reassigning files, removing other logins) can follow calmly over the next few days, in order.
What about their phone and laptop?
Collect them, then either wipe the device for the next person or retire it. If work data ever lived on the device itself rather than just in the cloud, make sure it's removed properly, and take the person off any group email lists.
Do we need to keep their emails for legal reasons?
Sometimes — certain industries must retain records for a set period. Converting the mailbox to a shared mailbox keeps everything searchable, which covers most needs, but if you're in a regulated field it's worth confirming your retention obligations before deleting anything.

Keep reading

Book a consult

Let's talk about what's not working

The first conversation is free and pressure-free. You talk, we listen, and by the end you'll have at least one concrete thing you can act on — whether you work with us or not.

30 minutes, via phone or video

We come prepared if you share your brief first

Flexible scheduling, including evenings and weekends

What to expect

0–5 min

Context

We learn about your business and what's not working

5–20 min

Diagnosis

We ask specific questions and share our initial read

20–30 min

Next steps

You leave with at least one concrete recommendation

“James created something that I have no doubt is the reason my practice has been at capacity for years.”

— Donovan Bigelow, LMHC