An employee resigns on a Friday afternoon. By Monday, someone has collected the laptop, HR has the paperwork, and everybody considers it handled.
It is usually not handled. The laptop is the visible part and the least important one. What matters is the forty or fifty places that person could still sign in from any device in the world — and in most businesses, nobody has a list of those places.
We are called in after this goes wrong often enough to recognise the pattern. Here is the sequence that actually protects the business, in the order it needs to happen.
The First Hour Is About Access, Not Hardware
The single most important action is also the one most often skipped: disable the account and invalidate the sessions.
Changing a password is not enough on its own. A browser that is already signed in stays signed in, sometimes for weeks, because the session token was issued before the password changed. Someone can walk out of the building, open a laptop at home, and still be inside your email. The step that closes this is revoking active sessions and refresh tokens, and it takes about thirty seconds when someone knows to do it. Where sign-in runs through one corporate identity, it is a single action rather than forty.
The order that works: disable the account, revoke active sessions, remove the second factor enrolment so it cannot be used to re-authenticate, then convert the mailbox rather than deleting it. Deleting is the instinct and it is the wrong move — we will come to why.
Do this at the moment of separation, not at the end of the day. For a voluntary departure with notice, that means the moment the last day arrives. For anything involuntary, it means while the conversation is happening, not after it.
Where Access Actually Hides
Your directory covers what your directory knows about. The exposure lives in what it does not.
Applications signed up for directly. Every service a department adopted with a corporate card and a work email. Marketing tools, design software, scheduling apps, the analytics platform somebody trialled in 2023. These are the ones that outlive an employee by years.
Shared logins. The social accounts, the domain registrar, the account with the freight company, the bank portal with one login the finance team passes around. If a departing person knew any shared credential, it has to change, and there is no automated way to know which ones they knew.
Personal devices. Company mail configured on a personal phone is the most common one. If it was set up outside your management, removing it is a conversation rather than a command.
Keys and tokens rather than passwords. API keys, SSH keys, personal access tokens, service accounts created under an individual’s name. These are invisible to a normal offboarding checklist and they do not expire. For any technical role, this is the category that matters most and gets checked least.
External systems. Client portals, vendor extranets, the building access system, the alarm code, the shared drive a customer granted access to. None of it is yours to disable, which is exactly why it has to be on a list.
The Mailbox Is a Business Record, Not a Person’s Inbox
Deleting a departed employee’s mailbox to save a licence is the most expensive small saving in this whole process.
That mailbox holds contract negotiations, client commitments, vendor agreements, and the paper trail of whatever the person was in the middle of. You will want it during a dispute, an audit, or a customer relationship that turns sour eighteen months later. In litigation, having destroyed it is materially worse than the storage cost of keeping it.
What to do instead: convert it to a shared mailbox, which generally removes the licensing cost while preserving the contents, and give the manager access. Set up forwarding or an auto-reply that names a real human being — not a generic address — so clients are not writing into silence. Keep it for as long as your retention policy says, and if you do not have a retention policy, this is the moment to write one.
The same logic applies to files. Personal storage areas disappear with the account unless you transfer ownership first. Do that before disabling anything, not after, because recovering it afterwards is a support ticket and sometimes an impossibility.
Getting the Laptop Back, and What If You Cannot
For anyone in the office, this is a solved problem: collect it on the last day and check it in against an asset record.
Remote staff are where this quietly falls apart. A prepaid shipping box sent before the last day, with a deadline and a named person expecting it, recovers the hardware far more reliably than an email asking them to send it back. Companies routinely lose machines simply because nobody made returning one easy.
If a device does not come back, you need to have decided in advance what you can do about it. A machine enrolled in management can be locked or wiped remotely; an unmanaged one cannot, and that is a decision you made months earlier whether or not you realised it. Encryption is the backstop — an encrypted disk with the account disabled is a brick to anyone who has it, which converts a data breach into an inventory write-off.
Whatever comes back, do not hand it to the next person still carrying the old profile. Wipe and rebuild. It takes an hour and it prevents the category of incident where somebody finds a predecessor’s files on a machine they were given.
The Departure Nobody Planned For
Everything above assumes two weeks’ notice and a civil exit. Plan for the other kind, because that is when the gaps cost real money.
For an involuntary termination, access should be cut during the meeting, not after it. That means HR and IT coordinate on a time, and someone is ready to execute at that minute. The usual failure is a well-intentioned delay — waiting until the person has left the building, by which point they have had forty minutes on a phone.
Where there is genuine concern about the circumstances, preserve before you change anything. Take a copy of the mailbox and the files first, then disable. Once accounts start getting altered, reconstructing what was there becomes an expensive forensic exercise rather than a copy operation.
And write down what a departing person had access to, on the day they leave. Six months later, when a question arises, that list is the difference between a short answer and a very long investigation.
What Should Exist Before Anyone Resigns
All of this is straightforward when the groundwork is in place and close to impossible when it is not.
Three things to have ready. An inventory of every service the business pays for and who can sign in to each — this is the one nobody has and the one that makes everything else possible. A named owner for each of those services, so there is someone to ask. And a written sequence with the steps in order, so the process does not depend on whoever happens to be available that afternoon.
Single sign-on is what turns this from a checklist into a switch. Where staff reach applications through one corporate identity, disabling that identity closes most doors at once. It is worth doing for that reason alone, separate from any security argument, and it pays for itself the first time somebody leaves in a hurry.
Offboarding Questions, Answered
How quickly should access be cut off?
At the moment of separation. For a resignation with notice, the last working day. For an involuntary termination, during the conversation rather than after it.
Should we delete the account to save the licence?
No. Disable it and convert the mailbox to shared storage, which usually removes the licence cost while preserving the contents. Deleting destroys business records you may need for years.
What if the employee will not return their laptop?
A managed machine can be locked or wiped remotely. An unmanaged one cannot, which is why full disk encryption matters — with the account disabled and the disk encrypted, the hardware is a loss rather than a breach.
Do we have to change shared passwords every time someone leaves?
Any shared credential the person knew, yes. This is the strongest practical argument for replacing shared logins with individual accounts, which makes a departure a single revocation rather than a scramble.
How long should we keep a former employee’s files and email?
As long as your retention policy specifies, and longer if there is any hint of a dispute. Most businesses land between one and seven years depending on their industry and what their clients require of them.
What about access to systems that belong to our clients?
Notify the client and ask them to remove the account, then confirm in writing that they did. You cannot revoke it yourself, and an orphaned account on a customer’s system is their exposure and your reputation.
Want This Running Without You Thinking About It?
For the businesses we support, departures follow a documented sequence with a record of what was done — access closed the same day, mailboxes preserved properly, hardware tracked, and a written list of what that person could reach. Nobody has to remember the steps at four o’clock on a Friday.
Call (213) 873-7620 or book a free IT assessment and we will start with the inventory of who can sign in to what, which is usually the eye-opener.
Related reading: Dark Web Monitoring for Business · CCPA Compliance in 2026