When an employee leaves: close access without disrupting work

A salesperson leaves the company on Friday. On Monday, their replacement needs to find outstanding quotes, respond to customers and access project files. At the same time, the departing employee’s access must be closed. These two objectives need to be planned together.

Here is a starting checklist for a small business. It also applies when a contractor’s assignment ends, with the list adapted to the tools actually in use.

1. Plan the handover before closing access

Assign someone to coordinate the departure and agree with management on the access cut-off time. For each tool, record who will take action and who will take over the work. A simple table is enough: tool, account, person closing access, successor and check result.

ANSSI recommends formal arrival and departure procedures to update permissions and recover equipment. The procedure should cover physical access as well as IT access.

2. List the access actually in use

• Business email and calendars.
• Shared folders, cloud storage and business software.
• Remote access, VPN and remote support tools.
• The website, social media and supplier accounts.
• Administrator accounts, shared passwords and recovery methods.
• Laptop, phone, security keys and access badge.

The trap is to focus only on the returned computer: a browser-based account may still work elsewhere. Tools purchased directly by a team deserve as much attention as the office server.

3. Block sign-ins and check sessions

At the agreed time, the administrator blocks sign-ins and revokes sessions using each service’s procedure. For Microsoft 365, the documentation distinguishes password resets, signing out sessions and blocking the account. These actions may take effect at different times: clicking a button does not prove that every connection has ended.

If a secret was shared, coordinate its replacement with the people concerned. Also remove permissions that are no longer needed and recovery methods tied to the departing person.

4. Preserve what the team needs

Before deleting an account or removing a licence, arrange the preservation and handover of necessary business data. Microsoft provides separate steps for email and OneDrive, among other services. The conditions depend on the service and its configuration.

An authorised person should take over the files using their own account. Decide how future messages will be handled and limit access to the information needed for the handover, respecting company rules and confidentiality.

The check before closing the departure

Returning to our example, the replacement opens an outstanding quote folder with their own account and finds what they need to answer the customer. Separately, the administrator checks revoked access, remaining sessions and returned equipment.

Record a date, an owner and a result for each row in the table. Unverified access remains an open task. Close the departure once the planned checks are complete and the handover has been confirmed.

Do you lack a reliable list of accounts and permissions? An IT assessment can help you start there before the next departure.