Employee Offboarding: The Access Checklist Most Businesses Miss
When someone leaves, most businesses disable their email and consider it done. Access survives in a surprising number of other places. Here's where to look, and a checklist HR can run on the last day.
The breaches that actually hurt small businesses are rarely sophisticated. Very often, they’re a login that was never turned off.
A departure is when that happens. Someone leaves on a Friday, their email is disabled on Monday, and everyone moves on — while their access to half a dozen other systems quietly carries on.
Where access survives
Disabling the mailbox closes one door. These stay open:
- Saved sessions. Browsers and apps stay logged in long after a password changes.
- App passwords and API tokens. Created for an integration years ago, and never tied to the main login.
- Mail forwarding rules. Set up before they left, still quietly copying mail to an outside address.
- Shared passwords. The social media account, the Wi-Fi, the supplier portal, the router admin page.
- Recovery details. A phone number or personal email set as the recovery method on a business account.
- Third-party services. Accounting software, the CRM, the domain registrar, the hosting control panel — none of which may use your email login at all.
- Physical and remote access. Door codes, alarm codes, VPN profiles, remote desktop tools.
The most serious case: a former employee who is the registered owner of your domain or hosting account. That’s real leverage over your business, and it’s far easier to fix while the relationship is still friendly.
The last-day checklist
Run this on the day someone leaves — ideally before their last login:
- Disable the directory account (Microsoft 365, Google Workspace) and revoke all active sessions.
- Remove forwarding rules and delegated mailbox access.
- Revoke app passwords, API tokens and OAuth grants.
- Rotate every shared credential they knew — Wi-Fi, social media, supplier portals, router and firewall admin.
- Check recovery details on business accounts for their phone number or personal email.
- Remove them from third-party services — accounting, CRM, banking, hosting, domain registrar.
- Transfer ownership of anything registered in their name.
- Change door, alarm and VPN access.
- Record what was done and when.
Make the next one easy
Most offboarding pain comes from shared logins. If five people use one password, removing one of them means changing it for everyone — so it doesn’t get done.
Named accounts with defined roles turn offboarding into a single action. A password manager with a company vault makes the remaining shared credentials easy to rotate.
If this is already overdue, see someone left months ago and we think they still have access. The broader work sits in our cybersecurity practice.
- Access Control
- Offboarding
- Cybersecurity