An employee is leaving. What access should you remove?

Agree who does what, and when

Start before the leaving date where you can. Decide who is coordinating: usually the person's manager, whoever looks after HR, and your IT administrator or IT provider.

• The date and time access should end, and what happens if the person leaves at short notice.
• Who tells IT, and how much notice IT needs.
• Who takes over the person's work, files and shared mailboxes.

List every account, not just email

Email is the obvious one, but most people collect more access than anyone remembers. The National Cyber Security Centre (NCSC) recommends a joiners, movers and leavers process so that access is removed when it is no longer needed. Work through this list.

• Email and the main work account, such as Microsoft 365 or Google Workspace.
• Cloud applications with their own sign-in: accounting, payroll, banking, customer records, design tools, social media.
• Remote access, such as a VPN or remote desktop.
• Shared systems and shared mailboxes.
• The password manager, including anything shared with the person.
• Administrator and other privileged accounts, which need particular care.
• Accounts with suppliers and other third parties where the person is the named contact.

Disabling the main work account helps prevent new sign-ins to connected applications. Ask IT to check existing sessions and any separate application accounts, because additional action may be needed.

Block sign-in and end active sessions

Ask your IT administrator to block the person's sign-in and to sign them out of active sessions at the agreed time. Blocking sign-in does not always end every session at once. Microsoft's guidance for Microsoft 365, for example, says that signing a user out of all sessions can take up to an hour to apply everywhere, and that blocking an account can take up to 24 hours to take effect, which is why it puts a password reset first.

That is a reason to plan the timing with IT. It is not a reason to rely on a password change alone: changing a password does not recover devices, hand over files or close accounts held with other services.

Recover devices, and decide about personal ones

• Collect laptops, phones, tablets, security keys, access cards and removable storage.
• Check where work email or files were set up on the person's own phone or computer, so that those sign-ins end too.
• If business information is held on a personal device, follow your policy on how it is removed. Removing data from someone's own device is a decision to take deliberately, with IT, and not a routine step.

Hand over files and services

Before anything is deleted, decide what the business needs to keep and who will hold it.

• Give the person taking over access to the files, mailbox and shared folders they need.
• Transfer ownership of documents, shared drives, calendars and subscriptions registered in the leaver's name.
• Decide what happens to email sent to their address. Forwarding and a shared mailbox are common choices.
• Update the contact details held by suppliers, banks and customers.

Keep what you need before removing accounts or licences

Deleting accounts or removing licences can affect access to and retention of business information. Before taking either step, ask your administrator to check the settings that apply to mailboxes and OneDrive, including retention policies and holds, and confirm that the required handover is complete.

How long information must be kept, and who may look at a former employee's email or files, depends on your own policies and on legal requirements such as data protection and employment law. If you are unsure, take advice before deleting anything or opening someone's mailbox.

Change shared credentials they knew

Where the person knew a shared password or code, change it: the Wi-Fi password, shared logins that cannot be given individual accounts, alarm and door codes. Where you can, replace shared logins with individual accounts, so that the next departure is simpler.

Record what was done

Keep a short record: what was removed and when, who did it, what was handed over, and any exceptions, each with a reason and an owner. It answers questions later and gives you a template for next time.

When to involve your IT provider

Involve them as soon as you know someone is leaving, and immediately if the departure is sudden or difficult. Ask for their leavers checklist and add the accounts they do not manage. If the person held administrator rights, ask IT to review what those accounts could reach.