Step 1: Disable their primary account

Disable their Microsoft 365, Google Workspace, or other primary company login as soon as their employment ends.

Step 2: Revoke active sessions

Signing out of one device isn’t enough. Revoke active sessions so company accounts can’t remain logged in on a personal phone, home computer, or browser.

Step 3: Remove access to business applications

Think beyond email. Remove or transfer access to:

• CRM and accounting software
• File storage and collaboration tools
• Project management platforms
• HR and payroll systems
• Industry-specific applications
• VPN and remote access tools

Step 4: Reset shared passwords

Did they know the password to a shared account, vendor portal, Wi-Fi network, or other system? Change it. Better yet, replace shared credentials with individual user access wherever possible.

Step 5: Secure company devices

Collect laptops, phones, tablets, security keys, access cards, and other company-owned equipment. Confirm devices are returned, locked, and ready to be wiped or reassigned.

Step 6: Protect their email

Block sign-in, preserve the mailbox according to your company’s retention requirements, determine who should receive or monitor future messages, and convert to a shared mailbox to preserve the data. Don’t immediately delete the account.

Step 7: Transfer ownership of important files

Identify files, folders, calendars, documentation, contacts, and other business information the employee owned. Provide someone on your team access to their OneDrive, and transfer ownership before anything is deleted.

Step 8: Remove privileged access

If they had admin permissions, elevated system access, password-manager access, or access to sensitive company data, remove those privileges immediately.

Step 9: Check for automatic access

Review distribution lists, shared mailboxes, Teams or Slack groups, recurring reports, integrations, API access, and other places where access may continue automatically.

Step 10: Document the offboarding

Record what was disabled, transferred, collected, and changed, along with who completed each step. A repeatable process is much safer than relying on memory.