When someone leaves your organization, the goal is simple: they lose access to everything, and you lose access to nothing. Most small businesses get the first half half-right and forget the second half entirely, which is how a departure turns into a month of hunting for files, invoices, and passwords.
Here is the order that actually works, whether the person is retiring after fifteen years or walking out on a Tuesday.
Before you delete anything
The instinct is to delete the account. Don't. Deleting a Microsoft 365 or Google Workspace account can take the mailbox, the calendar, and the files that person created with it, and recovering them ranges from fiddly to impossible depending on how long you wait.
Instead, block sign-in first. In Microsoft 365 that's the "Block sign-in" option on the user; in Google Workspace it's "Suspend user." The person can no longer get in, but everything they had still exists and you can go through it at a normal pace.
While you're there, reset the password too, and sign the account out of all active sessions. A blocked account with a phone still holding a valid login token is not as blocked as it looks.
The list of things to actually check
Work through this in one sitting if you can. It takes twenty minutes for a typical staff member and saves you a bad afternoon later.
- Email forwarding. Point their address to a manager or a shared mailbox so customers who email the old address still reach someone. Then check whether they had set up any forwarding rules of their own.
- Shared files. Anything saved to their personal OneDrive or My Drive belongs to them, not the company, as far as the system is concerned. Move what matters into a shared location before the account goes away.
- Two-factor codes. If their phone was the second step for a bank, payroll, or hosting login, that login is now half broken. Move it to a phone you control.
- Anything not on your email system. The domain registrar, the website admin, Shopify, Stripe, QuickBooks, the payment terminal portal, the insurance provider, the phone system, social media accounts. These rarely live in one place and are the most common thing forgotten.
- Physical items. Laptop, phone, keys, fobs, the USB drive in the desk drawer, and any printed passwords taped under a keyboard.
- Building and network access. Alarm codes, door fobs, and VPN access — a VPN being the secure tunnel staff use to reach the office network from home.
Then wait, then clean up
Once the mailbox has been reviewed and the files moved, keep the blocked account in place for a while. Ninety days is a reasonable default, and it costs you one licence at most. Questions surface late: which supplier sent that quote, what did we promise that customer in March.
After that window, convert the mailbox to a shared mailbox if you still want the history, and remove the licence. Then delete the account properly, so it isn't sitting there as a dormant login nobody watches.
The part most places skip: write down what you did. A one-page offboarding checklist on your shared drive, updated the first time you use it, means the next departure isn't a memory exercise. Add a matching onboarding page while you're at it — the two lists are mostly the same items in reverse.
Stale accounts are one of the things we look at during regular maintenance passes, because a login nobody has thought about in two years is a login nobody is watching. But you don't need help to do the list above. You need the list, and twenty quiet minutes on the day it happens.
