Joining a company usually has a checklist. Leaving often does not. The laptop comes back, the email signature is removed from the website, and everyone assumes the rest followed. In practice, the Microsoft 365 account still signs in on a personal phone, the password manager still shares the supplier logins, and the firewall still has their mobile number for SMS resets.
Offboarding is the mirror of IT onboarding for new staff. Same list, in reverse, on the last working day — not the week after, when you notice mail bouncing. It also protects the person leaving: they should not still be able to see customer data they no longer have a reason to hold.
Same day: block, then harvest
On the last day, or the moment a departure is unfriendly, block interactive sign-in. That stops Outlook on a phone and Teams on a home PC without deleting anything. Then decide what must be kept. Shared mail needs a forwarding rule or a conversion to a shared mailbox. OneDrive files that the role still needs belong in a SharePoint site, not in a personal library you are about to delete. That is one reason OneDrive is not a backup.
Collect the laptop, badge, keys, authenticator tokens and any SIM that is on a company contract. A device that never comes back is a data problem as well as a hardware one. If the machine was not encrypted, treat it as a missing copy of whatever was on it.
Tell the people who needed to work with them. A short internal note plus an auto-reply on the mailbox (“X has left; please contact Y”) stops customers writing into a black hole. Do not leave that auto-reply in place for a year with nobody reading the mailbox behind it.
The logins everyone forgets
- Microsoft 365, including Teams, OneDrive, SharePoint and any admin role they held
- Password manager vaults and shared folders — revoke, do not just “ask them to log out”
- Website, hosting and domain registrar panels
- Banking, payroll, Companies House, HMRC and other gov.uk gateways
- Social media, Google Business Profile, advertising accounts and the office Wi‑Fi admin page
- Line-of-business software, VPNs, remote desktop and the alarm or CCTV app if IT was involved
A password manager with a company vault makes this list shorter. A spreadsheet of shared passwords makes it longer and less honest, because you will never know whether they kept a copy. If you are still on the spreadsheet, read password managers for small teams before the next leaver, not during it.
Contractors and temps count. A booking they did on a personal Microsoft account, or a Canva login they created with their Gmail, will not appear on your Microsoft 365 leaver report. Ask during onboarding where work will live, so offboarding is not a scavenger hunt.
Directors and IT admins need a second person who can complete this list. If the only global admin is the person leaving, you have a business continuity problem that a last-day checklist cannot fix. Add a second admin while relations are still good.
Keep a dated note of what you switched off. If a customer later says a mailbox was read after the leaving date, you want a record, not a memory. The note can be a one-page checklist with ticks. It does not need to be a legal essay.
Website and customer-facing traces
Remove their photo and direct dial from the website when it is no longer accurate. Update “meet the team” pages so enquiries do not chase a ghost. If they were a public contact on Google Business Profile or LinkedIn company admin, move those roles. None of this is unkind. It is how customers reach someone who still works there.
Do the same for email signatures other people still send. A colleague’s footer that lists the leaver as the accounts contact will keep work arriving at a mailbox you have just closed. A five-minute search of shared signatures saves a week of bounced mail.
Garvey's IT runs leaver checklists as part of managed IT support for offices we already look after in Stockton-on-Tees and across the North East. We can also tidy website staff pages through web design support. Send us the leaving date and we will work through accounts, devices and the public pages in one pass.
Common questions
Should we delete a leaver’s Microsoft 365 account on their last day?
Block sign-in on the last day. Keep the mailbox and OneDrive long enough to move shared mail, files and Teams ownership, then remove the licence. Deleting first is how invoices and client folders disappear. Leaving the account open is how post ends up in a personal phone months later.
What if the person leaving is the only admin?
Fix that before the last day if you can. Add a second named admin, confirm MFA on it, and store the break-glass process where more than one director can find it. If they have already gone, a Microsoft 365 partner or your IT support firm can work through account recovery with you — do not share remaining passwords in a group chat while you improvise.