How Should a Business Handle Employee Offboarding and Former Employee Accounts?

Employee offboarding should remove or reassign access promptly while preserving the business information the organization still needs. A reliable process coordinates HR, management, IT, and application owners across identity accounts, separate applications, shared credentials, devices, physical access, and company data.

Collecting a laptop and key fob addresses only the visible part. Email, file storage, accounting systems, phone applications, vendor portals, shared passwords, personal devices, active sessions, and recovery methods can require separate review. Employee offboarding works best when the organization knows which systems exist, who owns each decision, and what information must be retained.

What Are the Key Takeaways?

• Employee offboarding requires coordination among the people who know about the departure and the people who control accounts, devices, data, and physical access.
• Work in three layers: the main identity account, separate application logins, and everything unofficial.
• Shared credentials may require a password change, active-session revocation, and a review of recovery and multifactor authentication methods.
• Separate removing access from preserving data so the organization can retain email, files, or records it is authorized and required to keep.
• If onboarding is undocumented, it becomes harder to verify whether employee offboarding covered every system and account.

What Does Employee Offboarding Actually Need to Cover?

Think of employee offboarding as three access layers rather than one universal checklist. Different people may control each layer, so the organization needs a named owner and a documented handoff for every action.

• Identity. The main account used for services such as Microsoft 365 or Google Workspace. Review sign-in status, active sessions, authentication methods, recovery details, administrative roles, and connected devices according to the platform’s documentation.
• Applications. Anything that has its own separate login: accounting, payroll, CRM, project tools, e-commerce, banking portals, vendor and supplier sites.
• Everything unofficial. Shared passwords, a personal phone with a company mail application, a home computer with synced files, a personal cloud account used for work, or an AI tool registered with a work email address.

The unofficial layer can create visibility gaps because the business may not have issued or recorded those accounts. A current inventory of hardware, software, data, and services makes the review more reliable. The FTC’s small business cybersecurity guidance recommends controlling access and maintaining an inventory of the technology and data a business uses.

Which Accounts Are Easy to Miss?

Accounts outside the main identity platform deserve a separate review because disabling one central account may not affect credentials managed by another vendor.

• Shared logins. If several people use one credential, disabling an individual account does not change that shared access. Reset the shared password, revoke active sessions where supported, review recovery and multifactor methods, and consider replacing shared access with individually assigned accounts.
• Vendor and supplier portals. Ordering, warranty, support, and purchasing sites may use credentials that are separate from the company’s main identity platform.
• The phone system. Softphone apps and voicemail can keep working on a personal device.
• Multifactor authentication. If a former employee’s phone remains registered as an approval or recovery device, the organization should review and replace that method through the platform’s administrative controls.
• Anything they signed up for. Free tools, trials, and AI accounts registered with a work email address.

How Quickly Should Employee Offboarding Remove Access?

The timing depends on the role, systems, circumstances, and organization’s approved procedures. Decide the sequence and responsible people in advance. For Microsoft 365, Microsoft’s guidance for removing a former employee treats blocking sign-in, saving mailbox contents, wiping and blocking mobile devices, forwarding email, granting access to OneDrive and Outlook data, removing the license, and deleting the account as separate steps, which is why administrators should follow the vendor’s complete process rather than rely on one setting. Microsoft also notes that after an account is deleted, its OneDrive and Outlook content is retained for 30 days; after a license is removed without deleting the account, email, contacts, and calendars are retained for 30 days, while OneDrive content can remain accessible beyond that period.

It also helps to separate removing access from preserving data. Depending on the platform and configuration, deleting an account can start a retention or deletion timeline for email, files, calendars, and other records. Determine what the business is authorized or required to retain, assign access to an appropriate current user when needed, and follow the vendor’s documented retention process before deleting the account.

The NIST small business cybersecurity resources describe access control, asset awareness, and protection of business information as parts of cybersecurity risk management. The exact employee offboarding steps still depend on the organization’s environment, policies, legal obligations, and vendor platforms.

A useful employee offboarding review has five distinct jobs: remove or reassign identity access, close separate application access, revoke shared credentials and authentication methods, preserve required business data, and recover organizational devices or property. Treating those as separate jobs makes it easier to see which owner must confirm each one.

Which Questions Should You Be Able to Answer Today?

You are not looking for perfect answers. You are looking for the ones nobody can answer at all.

1. Is there a written list of every system a new hire gets access to? If onboarding is undocumented, it is harder to verify that offboarding covered every account.
2. Who is responsible for removing access, and who tells them someone is leaving? An undefined handoff between the person who knows about the departure and the person responsible for access changes may create delays.
3. Do you know which accounts are shared? Shared credentials may require a password reset, session revocation, and replacement of recovery or multifactor methods.
4. What happens to the departing person’s email and files? Decide before the day, not after.
5. Could a former employee still approve a multifactor prompt? Check which phone numbers and devices are registered on shared or administrative accounts.

What Does an Unsure Answer Reveal?

An unsure answer may reveal that ownership, notification, or documentation has not been defined. Employee offboarding can involve HR, management, IT, finance, facilities, and outside vendors. Recording who authorizes each action, who performs it, and who verifies completion can expose gaps and reduce missed handoffs without assuming that one checklist fits every business.

What Else Should Businesses Know About Employee Offboarding?

Do we have to delete a former employee’s email account right away?

Not necessarily. Immediate deletion may start a vendor-specific retention or deletion timeline for email, files, and other records. The organization should follow the platform’s offboarding process to restrict access and revoke active sessions, then decide separately what information it is authorized or required to retain, who should receive appropriate access, and when the account can be removed. Record-keeping obligations and legal holds should be reviewed with the organization’s advisors.

What about accounts on an employee’s personal phone?

If a personal device contains work applications or business data, the available actions depend on how the account and device were configured. Administrators may need to disable access, revoke active sessions, review registered authentication methods, and use an organizational-data wipe where device management supports it. Previously downloaded files may require separate handling under the company’s device and employment policies.

Is this different when someone leaves on bad terms?

The categories to review may remain similar, but the timing, authorization, and coordination can change when a departure is involuntary or contentious. The organization’s approved HR, legal, and technology procedures should determine who authorizes the changes, when access is restricted, and how business data and property are handled.

Not Sure What a Former Employee Can Still Reach?

A current list of systems, access owners, and required actions can make employee offboarding easier to verify. Businesses in Venice, Sarasota, and North Port can ask NUPC Technology whether its co-managed IT services or managed IT services fit their situation. Request an IT consultation or call (941) 888-4474.