Someone Left the Team: A Small-Business IT Offboarding Checklist

This is not HR or legal advice. It is the IT cleanup that owner-led teams often skip until someone tries to reset a shared password three months later and realizes the only person who knew it is gone.

When someone leaves a small business, the goal is simple: they should not be able to sign in, customers should not bounce, and you should not lose files because someone clicked “delete user” too fast.

Same day: stop access, do not erase yet

Do this before end of day if you can. Disable first; delete later.

• Disable the account in Microsoft 365 / Entra ID (or Google Workspace). Do not delete on day one unless you are sure nothing lives only in that mailbox.
• Reset any shared passwords they knew—Wi‑Fi, admin portals, vendor logins, the shop iPad PIN if it was one code for everyone.
• Collect company devices or confirm remote wipe if the laptop is not coming back.
• Remove them from MFA apps on shared accounts if your team uses a shared login (see below).

Disabling sign-in is reversible. Deleting a mailbox with six years of client threads is not.

Email: forward, do not panic-delete

The usual Monday-morning problem is not “they still have access.” It is “their email stopped and nobody knows where the threads went.”

• Set a forward or shared mailbox so someone active receives new mail to their old address.
• Decide who owns ongoing conversations—often the office manager or whoever handled their clients.
• Check auto-replies and rules they set up. Out-of-office messages from disabled accounts confuse people.
• Look at distribution lists and shared calendars they owned. Those break quietly.

Files: OneDrive and shared drives

People store work in odd places. Before you delete anything:

• Check their OneDrive (or Google Drive) for client folders that never made it to the shared location.
• Move what the business needs into a folder the team already uses.
• Note anything that looks personal and handle that separately—keep the IT steps boring and documented.

Licenses and apps you pay for

• Remove their Microsoft 365 license once mail and files are handled—you are paying monthly for idle seats more often than you think.
• Check line-of-business apps (QuickBooks users, CRM seats, Adobe, industry tools). One leftover seat is easy to miss on a credit card.

The shared-login problem

If your team still uses info@yourcompany.com with one password on a sticky note, offboarding is messier. You cannot “disable Bob” when everyone signs in as Bob. This is a good moment to split shared mailboxes from personal accounts—even one proper user account per person makes the next departure much calmer.

We help with this often. It is unglamorous and worth doing once.

After 30 days: delete or archive

When you are confident nothing important lives only in that account:

• Delete the user or convert the mailbox to a shared mailbox with no license, depending on what you still need.
• Update your password manager or documentation so the next person is not guessing.
• Write two sentences in your internal notes: what you did and who owns their old responsibilities now.

When to get help

If the person was an admin, touched your Microsoft tenant, or you are not sure whether deleting them will break accounting software, pause and ask. A short support session beats rebuilding permissions from memory.

Related services: Microsoft 365 & cloud, Security & device management. Request support if you want a second set of eyes before you click delete.