Turning off company email is a start, but it may not remove access to accounting, project tools, shared folders, or customer systems. It also does not decide what happens to the person’s business records.

Use a short coordinated plan: agree on timing, preserve what the business must keep, remove access, and verify the result. Have your IT provider carry out technical steps and the responsible manager approve the business decisions.

Before the departure, agree on the exact cutoff

Record the worker’s name, manager, last working date, and access cutoff with a time zone. Name one coordinator and tell the provider who may authorize changes. Coordinate timing confidentially for involuntary or higher-risk departures.

Keep employment decisions and legal questions with the appropriate manager, HR contact, or adviser. If you suspect an incident or data misuse, involve the incident lead and qualified responders rather than conducting an improvised investigation.

Preserve business records before deleting anything

Identify files, mail, customer contacts, scheduled jobs, and business services owned by the account. Decide who takes over. Check retention requirements, legal holds, and relevant privacy rules before deletion or broad mailbox access.

Use supported ownership-transfer or delegated-access methods. Do not ask for the departing person’s password and continue operating as them. Your provider should confirm how account status and license changes affect retention in each service; do not assume every platform has the same recovery window.

Microsoft’s former-employee guidance treats blocking access and preserving business data as separate tasks. Follow current platform instructions for your actual configuration.

At the cutoff, work through the account list

Use the list below as a starting point, adding systems specific to your business. Mark each item complete with an owner and evidence, or not applicable with a reason.

  • Company identity and email: block further sign-in and arrange authorized handling of retained records.
  • Existing access sessions: have the provider revoke sessions, tokens, app passwords, and other access methods as applicable. Changing a password is not a universal sign-out mechanism.
  • Applications outside the main login: check accounting, payroll, project management, marketing, website administration, domain registration, hosting, password vaults, and supplier portals.
  • Shared information: remove folder memberships, delegated access, and unnecessary external shares. Consider links or permissions granted outside normal groups.
  • Remote and customer access: remove VPN or other remote access, and coordinate authorized removal from customer-managed systems.
  • Shared secrets and automation: rotate credentials the person knew where necessary, revoke their API keys, and move legitimate scheduled work to an approved owner.

Some applications manage their own sessions and access rules. Ask your provider to verify each critical service instead of treating the central account change as proof that everything is closed.

Collect equipment and manage personal devices carefully

Record the return of laptops, phones, keys, badges, and storage media, including asset identifiers and condition. Flag missing equipment and assess exposure promptly.

For personal devices, use the agreed, authorized process to remove company work data. Do not casually wipe the entire device. Consider privacy, legal holds, and evidence preservation before remote removal. Unreturned or suspected compromised devices may require incident response.

Verify that the business can still operate

A completed task list should not leave payroll dependent on a departed employee’s account. Confirm the new owner can access required files and services through their own authorized account. Check forwarding rules and notifications for appropriate handling, and remove temporary handover access when it expires.

For an illustrative departure, an owner disables email but forgets the standalone accounting login. A service-by-service check catches the gap. The lesson is to inventory actual access, not assume every tool shares the same sign-in.

A message to send your IT provider

[Worker] leaves on [date]. The authorized access cutoff is [time and time zone], approved by [manager]. Please confirm the accounts, separate applications, active sessions, devices, and shared credentials to address. Before deletion, verify retention and holds and arrange approved ownership transfers. Return a completion record with outstanding items and who will resolve them.

Keep this request in a restricted channel and share only necessary personnel information.

Close the record, then improve the next departure

Have the manager and technical verifier record completion, unresolved items, and follow-up dates. Preserve the record under approved retention rules. If you discovered an application nobody had listed, add it to your system inventory now.

Use the same structure when someone changes roles or a contractor’s project ends. If access and data ownership are uncertain today, start with the systems the person can use to reach money, customer data, or administrative controls.

For connected tasks, read how to check your backups and how to answer a customer security questionnaire. This checklist is general operational guidance, not employment or legal advice.