When someone leaves: closing accounts and access
An employee offboarding checklist keeps a departure from leaving a door open: reset the person’s password and sign them out, remove their sign-in methods and devices, transfer their files and email, change every shared password they knew, and move anything registered in their name. CISA, NIST, the UK’s NCSC, and Canada’s Cyber Centre all ask businesses to define and apply such a process.
An employee offboarding checklist for your accounts
Prepare the handover before the last day, cut access on the day, and delete the account only once everything useful has moved. The order matters because some steps cannot be undone: a deleted account takes its files with it after a few weeks. This is the departure step of securing your team’s accounts, and CISA lists a defined offboarding process among its cybersecurity performance goals, as a low-cost, high-impact measure.
The official guides agree on the core. CISA asks for the return of tokens and badges and the revocation of all access, for staff, contractors, and vendors alike. NIST adds an exit interview, the recovery of equipment, and continued access to the information the person controlled. The NCSC and Cyber Essentials ask for accounts to be removed or disabled when someone leaves, and Australia’s ASD for shared credentials to be changed.
The checklist
| When | Step |
|---|---|
| Before the last day | List the person’s accounts, devices, administrator roles, and the shared logins they know |
| Before the last day | Transfer their files, calendars, and password manager items to someone who stays |
| Before the last day | Move administrator roles; make sure they are not the last administrator |
| Before the last day | Move anything registered in their name or personal email: domain, social media pages, ad accounts |
| On the day | Reset their password and sign them out of every session |
| On the day | Remove their sign-in methods: MFA, recovery email and phone, security keys, app passwords |
| On the day | Wipe company data from their phone, and collect laptops, keys, and security keys |
| On the day | Remove them from shared mailboxes and groups; change every shared password they knew |
| Afterward | Convert or forward their mailbox, remove the license, then delete the account |
The fourth line has no official source behind it, but it is where small businesses get stuck: a domain renewed on a former employee’s card, or a Facebook page whose only full-control admin left. Google adds a reason to keep the domain under company control: recovering a locked super administrator account may require changing the domain’s DNS records.
In Microsoft 365, in Microsoft’s order
Microsoft’s guide to removing a former employee has seven steps. The paths below start in the Microsoft 365 admin center, as of November 2026.
- Prevent sign-in. Users, Active users, select the person, Reset password, then Sign out of all sessions. Microsoft notes that Block sign-in can take up to 24 hours, while a password reset stops sign-in immediately; existing sessions end within about an hour.
- Back up the mailbox if you need to keep its content.
- Wipe and block the phone, in the Exchange admin center: Recipients, Mailboxes, the person, Manage mobile devices, for example Account Only Remote Wipe Device, then Block access.
- Forward the email or convert the mailbox to a shared mailbox (Mail, Convert to shared mailbox). Reset the password after conversion: otherwise the old credentials still open it.
- Give someone access to their OneDrive and Outlook data.
- Remove the license (Licenses and Apps). Microsoft holds the user’s data for 30 days.
- Delete the account. It can be restored for about 30 days.
In the Microsoft Entra admin center, also remove the person’s MFA methods: Entra ID, Users, the person, Authentication methods, Require re-register MFA.
In Google Workspace
Google’s list for keeping data secure after an employee leaves covers the same ground: wipe mobile devices, remove the recovery email and phone number, change the password, revoke OAuth tokens, reset sign-in cookies, revoke security keys and app passwords, then transfer data and delete the account.
Three points are easy to miss:
- Suspending is not free. A suspended account keeps its data and stops receiving mail, but Google bills it at the same rate as an active one. On an annual plan, deleting a user does not reduce your number of licenses either.
- Transfer before you delete. Drive files can only go to an active user in your organization. A super administrator can transfer Drive and the primary calendar during deletion; secondary calendars must move first.
- Resetting cookies is not a full sign-out. Google says it does not sign the user out of apps such as Gmail or Google Drive for desktop: change the password and revoke tokens as well.
A deleted user can be restored for 20 days. Google also offers an Archived User license that keeps a former employee’s data without allowing sign-in.
The password manager
Shared vaults are the last door. 1Password asks you to have the person’s Employee vault transferred before deleting them, or its content is lost, and to assume that an owner or administrator saw every password in the vaults they managed. In Bitwarden, a revoked member loses access to the organization’s items and no longer uses a seat.
The shared passwords they knew
Every shared login the person used needs a new password. Our page on team logins without shared passwords shows how to have fewer of them next time.
Part of a wider routine
Departures are step 10 of the team security checklist, next to the access review every few months that catches what offboarding missed.