Someone puts in their notice.
HR handles the paperwork.
Their manager figures out who is taking over their responsibilities.
Payroll prepares the final paycheck.
Someone collects their keys.
Maybe there is a goodbye lunch and a slightly awkward card getting passed around the office.
Then Friday afternoon comes, the employee turns in their laptop, everyone says goodbye, and you move on.
Except there is one pretty important question left.
What still has their name on it?
Former employees can leave behind access to email, company files, Microsoft 365, cloud applications, saved passwords, VPN connections, customer information, shared accounts, and dozens of other systems.
Sometimes that access sticks around for months.
That is why employee offboarding should include more than collecting a laptop and disabling an email address.
A proper employee IT offboarding process should remove access to company systems, revoke active sessions, protect company data, recover equipment, transfer important information, remove shared credentials, and document that every required step was completed.
Here is what businesses should be doing every time an employee leaves.
What should IT do when an employee leaves a company?
The exact employee offboarding process will look different for every business.
A receptionist, accountant, salesperson, engineer, and company executive probably do not have access to the same things.
That is exactly why businesses need a documented process.
At a minimum, your IT offboarding checklist should consider:
- Disabling the employee’s company accounts
- Revoking active login sessions
- Removing remote access
- Removing VPN access
- Reviewing Microsoft 365 access
- Protecting the employee’s email
- Transferring company files
- Removing access to cloud applications
- Changing shared passwords
- Removing administrative privileges
- Recovering company equipment
- Protecting company data stored on devices
- Removing physical access when technology is involved
- Reviewing mobile devices
- Preserving information required for compliance or legal purposes
- Documenting that every required step was completed
That sounds like a lot.
It can be.
Modern businesses use a lot more technology than they did ten years ago, which means employees usually have access to a lot more systems.
The goal is to make sure nothing gets forgotten.
Employee onboarding and employee separation are both part of the repeatable processes built into Digital Boardwalk’s Fully Managed IT Services so businesses do not have to reinvent the process every time someone joins or leaves the company.
When should IT disable an employee’s account?
Timing matters.
If someone is leaving voluntarily at the end of the week, their access may need to remain available until their final day.
If an employee is being terminated unexpectedly, the situation can be very different.
You probably do not want to tell someone they have been terminated and then discover they still have access to email, company files, customer records, or administrative systems for another three hours.
HR, management, and IT should coordinate the timing.
For an involuntary termination, IT may need to be ready to disable access immediately as the termination occurs.
For a planned departure, IT can prepare everything in advance and schedule access changes around the employee’s final working day.
The important part is communication.
IT should not find out someone left the company because another employee submits a ticket three weeks later asking what to do with their mailbox.
Is disabling an employee’s Microsoft 365 account enough?
Not necessarily.
Microsoft 365 is often at the center of a company’s technology environment, but disabling one account does not automatically answer every offboarding question.
You still need to think about what happens to the information associated with that employee.
That could include:
- Outlook email
- OneDrive files
- SharePoint access
- Microsoft Teams
- Shared mailboxes
- Distribution groups
- Calendars
- Contacts
- Mobile devices
- Microsoft applications
- Administrative permissions
You may need to preserve their mailbox, transfer files to another employee, provide someone with temporary access to business communications, or remove the former employee from shared resources.
There may also be business records that need to be retained.
Digital Boardwalk is a Microsoft Solutions Partner and helps organizations manage Microsoft 365, SharePoint, Teams, cloud files, identity, and other Microsoft services as part of their broader technology environment.
The important thing to remember is that deleting an employee is easy.
Figuring out what should happen to everything they created is the part that requires planning.
What should happen to an employee’s email after they leave?
Do not immediately delete it.
That mailbox may contain conversations with customers, invoices, project information, vendor communications, contracts, scheduling details, or other information the business still needs.
Instead, decide what needs to happen to those communications.
Maybe another employee needs access to the mailbox temporarily.
Maybe incoming messages need to be redirected.
Maybe an automatic response should tell senders that the employee is no longer with the company and provide a new contact.
Maybe the mailbox simply needs to be preserved for historical purposes.
What you should not do is leave the former employee’s account active indefinitely because someone might need to check it later.
There are safer ways to preserve access to business information without keeping the former employee’s identity active.
What happens to an employee’s OneDrive files when they leave?
This is another easy one to overlook.
Employees frequently save important business information in their personal company OneDrive.
- Project files.
- Spreadsheets.
- Customer documents.
- Presentations.
- Internal notes.
- Templates.
Maybe even that mysterious spreadsheet everyone in accounting apparently depends on but nobody knows who created.
Before the employee’s account is removed, someone should determine what business information needs to be transferred and who should own it going forward.
The same thinking applies to SharePoint, Teams, local computer files, and other cloud storage platforms.
Your company should never permanently lose important business information simply because the person who created it left.
Should we reset an employee’s password when they leave?
Changing the password can be part of the process, but it should not be the entire process.
Think about all the places where an employee might already be signed in.
- Their laptop.
- Their phone.
- A tablet.
- A web browser.
- Microsoft 365.
- Cloud applications.
- Remote access tools.
A password change does not always immediately terminate every existing session.
That is why your offboarding process should include revoking active sessions and removing authentication methods where appropriate.
This is particularly important with cloud services because an employee does not necessarily need to be sitting inside your office to access company information.
They could be sitting on their couch at home.
What should happen to multi factor authentication when an employee leaves?
The former employee’s authentication methods should be removed as part of the account deactivation process.
That might include authenticator applications, phone numbers, hardware security keys, or other authentication methods associated with the user.
Multi factor authentication is one of the most important layers in modern cybersecurity, but it still needs to be managed correctly throughout an employee’s lifecycle.
Digital Boardwalk’s Managed Cybersecurity Services include enterprise MFA along with email security, endpoint protection, ransomware protection, password management, attack surface management, managed SIEM, security awareness training, and other layers designed to protect modern business environments.
Cybersecurity is not just about stopping hackers.
It is also about making sure the right people have access to the right things at the right time.
And removing that access when they no longer need it.
What happens if an employee knows shared company passwords?
This is where things can get messy.
Maybe your entire marketing department knows the password to a social media account.
Maybe five people share access to a vendor portal.
Maybe the office manager knows the password to the alarm system.
Maybe a former employee created a company account using their own email address years ago and nobody noticed.
Shared credentials make employee separation significantly more difficult because disabling one user’s company account may not remove their access.
Your offboarding process should identify shared passwords the employee knew and determine whether those credentials need to be changed.
Better yet, reduce how often employees need to know shared passwords in the first place.
Digital Boardwalk’s Managed Cybersecurity Services include a secure password vault designed to help businesses securely manage credentials rather than relying on spreadsheets, sticky notes, browsers, or the collective memory of the office.
The fewer passwords employees actually know, the easier they are to manage when someone leaves.
What should happen to company laptops and computers when an employee leaves?
Get them back.
That sounds obvious, but equipment recovery should still be documented.
Depending on the employee, company property could include:
- Laptop
- Desktop computer
- Monitors
- Docking station
- Mobile phone
- Tablet
- Security keys
- Headset
- External drives
- Hotspots
- Chargers
- Other specialized equipment
Once equipment is returned, it should not immediately be handed to the next employee.
IT should inspect it.
Company data should be protected.
Local user profiles may need to be removed.
The device may need to be wiped or reimaged.
Software may need to be updated.
Security settings should be verified.
Then it can be prepared for the next person.
This also gives the business an opportunity to update its technology inventory.
What if the employee used their personal phone for company email?
This is one of the reasons mobile device policies matter.
Employees may access company email, files, Teams, cloud applications, and other resources from personal devices.
When someone leaves, you need to know what company information may still be accessible from those devices.
The answer will depend heavily on how your technology is configured.
Organizations using Microsoft cloud technologies may be able to manage access through identity, security, and device management controls rather than physically touching the employee’s personal phone.
Digital Boardwalk helps organizations implement and manage Microsoft cloud technologies including Microsoft 365 and related identity, security, collaboration, and device management capabilities.
This is another reason businesses should establish these controls before an employee leaves.
Trying to figure it out afterward is much harder.
Should former employees still have access to the VPN?
No.
Remote access should be reviewed and removed as part of employee separation.
That includes VPN access, remote desktop systems, remote access software, cloud servers, and any other technology that allows someone to connect to company resources from outside the office.
Remote work has made this even more important.
Your former employee may no longer have a company laptop, but that does not necessarily mean they cannot access company systems.
Removing the physical computer is only one piece of removing access.
What about third party applications that are not managed by IT?
This is where employee offboarding often falls apart.
IT disables Microsoft 365.
HR collects the laptop.
Everyone assumes the job is finished.
Six months later someone realizes the former employee still has access to the company’s CRM.
Or accounting software.
Or project management platform.
Or payroll system.
Or website.
Or social media.
Or vendor portal.
Modern businesses can easily use dozens of cloud applications.
Your employee offboarding checklist should include an inventory of applications the employee had access to.
That is also why businesses should think carefully about who is allowed to purchase and implement new cloud applications.
If nobody knows a system exists, nobody remembers to remove access to it.
Should we remove administrator access separately?
Absolutely.
Privileged accounts deserve extra attention.
An employee with administrative privileges may have significantly more access than a typical user.
They might be able to create users, reset passwords, modify security settings, access servers, install applications, view sensitive information, or make changes that affect the entire company.
When someone with elevated access leaves, your IT team should review every privileged account and administrative role associated with that person.
This is also where continuous monitoring becomes valuable.
Digital Boardwalk’s Attack Surface Management continuously evaluates technology environments for risks such as unnecessary privileged users, disabled MFA, configuration changes, and other potential security issues.
You should not discover six months later that someone who left still has administrative access.
Do we need to preserve a former employee’s data for compliance?
Possibly.
This depends on your industry, legal requirements, internal policies, contracts, and the type of information your organization handles.
Some organizations have specific requirements around retaining email, communications, files, audit records, and other business information.
That means deleting everything associated with a former employee may not be the right answer.
Digital Boardwalk’s Managed Compliance Services help organizations implement and maintain technology controls associated with frameworks and requirements such as CMMC, HIPAA, PCI, SOX, ISO, and others.
If your organization has legal or regulatory retention requirements, those requirements should be built directly into your employee separation process.
Do not wait until someone asks for a record three years later to figure out whether you still have it.
What happens to backups when an employee leaves?
Backups are another important part of the conversation.
Deleting a Microsoft 365 account or removing files does not necessarily mean the business should lose the ability to recover important information later.
Digital Boardwalk’s Backup and Recovery Services include Microsoft 365 backup for SharePoint, OneDrive, Teams, email, contacts, and calendars.
That provides another layer of protection against accidental deletion, ransomware, and other situations where business information may need to be recovered.
An employee leaving should not create an unexpected data loss problem six months later.
What if an employee is terminated unexpectedly?
This is where having a process before you need it really matters.
An unexpected termination is probably not the moment you want HR and IT debating what needs to happen.
The process should already exist.
Management or HR should be able to notify the appropriate IT contact and provide the exact date and time access should be removed.
IT can then prepare the necessary actions in advance.
When the termination occurs, accounts can be disabled, sessions revoked, remote access removed, and other security steps completed at the appropriate time.
The employee does not need to be treated like a criminal.
The company simply needs to protect its systems and information.
A consistent process protects everyone involved.
Who should be responsible for the employee offboarding process?
Employee offboarding should usually be a shared responsibility between management, HR, and IT.
HR knows when the employee is leaving.
Management understands what responsibilities need to be transferred.
IT knows which technology access needs to be removed or preserved.
Problems happen when those groups operate independently.
A manager assumes HR told IT.
HR assumes the manager submitted a request.
IT has no idea the employee left.
Meanwhile, the account stays active.
A better approach is to establish one repeatable process with clearly defined responsibilities.
Digital Boardwalk’s Fully Managed IT Services specifically include refined employee onboarding and employee separation processes customized around each customer’s business.
The process should not depend on someone remembering who they were supposed to email.
How quickly should former employee access be removed?
For most systems, access should be removed as soon as the employee no longer has a legitimate business need for it.
That usually means their final working day.
For an involuntary termination, it may mean immediately when the termination occurs.
There should not be a vague period where everyone assumes the former employee probably will not log in.
Security should not depend on probably.
How can I tell if former employees still have access to my company?
This is a great question to ask your IT provider.
- Review your current users.
- Review Microsoft 365 accounts.
- Review administrative accounts.
- Review remote access.
- Review VPN users.
- Review cloud applications.
- Review shared accounts.
- Review security groups.
- Review company devices.
- Review authentication methods.
Then compare that information against the people who actually work for your company today.
You might be surprised by what you find.
This is one of the benefits of maintaining a comprehensive technology inventory and regularly auditing the environment rather than waiting until there is a problem.
Digital Boardwalk uses a proactive, process driven approach to technology management that includes routine audits and preventative maintenance designed to continuously improve a customer’s IT environment.
Finding an old account during an audit is much better than finding it during a security incident.
What should be on an employee IT offboarding checklist?
If you want a simple place to start, ask these questions every time someone leaves:
- Has the employee’s primary account been disabled?
- Have active login sessions been revoked?
- Have authentication methods been removed?
- Has Microsoft 365 access been removed?
- Has remote access been disabled?
- Has VPN access been removed?
- Have administrative privileges been removed?
- Have company files been transferred?
- Has email been preserved or redirected appropriately?
- Have shared passwords been changed?
- Has access to third party applications been removed?
- Have company computers been returned?
- Have company mobile devices been returned?
- Have security keys and other authentication devices been returned?
- Has the employee been removed from security and distribution groups?
- Has company data on returned equipment been protected?
- Have retention requirements been addressed?
- Has the technology inventory been updated?
- Has the entire process been documented as complete?
Not every employee will require every step.
That is fine.
What matters is that someone checked.
Why should employee offboarding be a documented IT process?
Because people forget things.
That is not an insult.
It is just reality.
When a business is busy, the urgent things get done first.
Employee separation may involve HR, payroll, management, facilities, accounting, IT, and other departments all trying to complete different tasks at the same time.
A checklist turns:
“I think we got everything.”
into:
“We confirmed everything.”
That distinction matters.
It matters for cybersecurity.
It matters for compliance.
It matters for data protection.
And it matters when the employee who managed your biggest customer leaves on Friday afternoon.
Is employee offboarding really a cybersecurity issue?
Absolutely.
Cybersecurity is fundamentally about controlling access to information and systems.
We spend a lot of time thinking about how to stop strangers from getting into our technology.
Hackers.
Phishing emails.
Malware.
Ransomware.
Those threats matter.
But businesses also need to make sure people who legitimately had access yesterday do not still have that access tomorrow when they no longer work there.
A former employee does not have to be malicious for an old account to create risk.
Unused accounts can be forgotten.
Forgotten accounts may not receive the same attention as active ones.
Credentials can be compromised.
Old permissions can linger.
That creates unnecessary exposure.
Good cybersecurity is not only about keeping bad people out.
It is about making sure access always matches the needs of the business.
How can my business improve its employee offboarding process?
Start by documenting what happens today.
- Who tells IT someone is leaving?
- How much notice does IT receive?
- What accounts are disabled?
- What happens to email?
- Who transfers files?
- Who collects equipment?
- Who checks third party applications?
- Who confirms everything was completed?
If the answer to several of those questions is:
“It depends.”
you have found a good place to improve.
The goal is to build a repeatable process that works the same way every time.
That is a big part of what mature IT operations look like.
Technology should not depend on someone remembering every little detail during an already busy day.
Digital Boardwalk helps businesses develop and maintain repeatable technology processes through our Fully Managed IT Services, Managed Cybersecurity Services, Microsoft Cloud Services, and Managed Compliance Services.
If you are not sure what happens to technology access when someone leaves your company, that is probably worth finding out before the next person gives notice.
Talk with the Digital Boardwalk team and let us help you build an employee separation process that protects your people, your technology, and your business.
Because collecting the laptop is easy.
Knowing you did not forget anything is the important part.