What happens when an employee leaves?

Someone left on Friday. By Tuesday somebody asks whether they can still get into the shared drive, and nobody in the room knows the answer.

Not because anyone was careless. Because nobody has ever written down what a person actually has access to, and there is no moment in a small business where that feels like the most urgent thing to do.

Offboarding gets done under time pressure, usually awkwardly, and almost always incompletely. This lesson is the order of operations, the four things nearly everyone forgets, and what to do when the departure was not planned.

It is written for a business with two to fifteen staff and no IT department. Which means it assumes you are doing this yourself, probably today, and probably while doing three other things.

The mistake that costs the most

The instinct is to delete the account. It feels final and it feels safe.

It is neither, and it is the single most expensive mistake in this whole process.

In most business systems, deleting an account starts a clock. The mailbox, the files that person owned, and anything they shared all become temporary. Some of it can be recovered for a short window. Some of it cannot be recovered at all. In Microsoft 365, a deleted account and its mailbox are held for a limited period and then they are gone — and the window is shorter than most people assume.

What you are actually trying to do is stop access while keeping everything the business still needs. Those are two separate jobs. The first is urgent. The second is not. Doing them in the wrong order is how businesses lose five years of a salesperson's client correspondence in an afternoon.

A note before you start: do not delete anything if there is a dispute

If the departure involves a disagreement, a complaint, an unpaid invoice, or anything that might end up in front of a lawyer, stop and get advice before deleting a single thing.

Mail and files belonging to a departing employee are often exactly the records that matter in a dispute, and destroying them — even accidentally, even in good faith — is a problem of a different order than losing a spreadsheet.

Block their access. Keep everything. Ask someone qualified.

The order that works

1. Block sign-in. Stop the account being used. This is the one genuinely urgent step and it takes about ten seconds. Everything else on this list can wait an hour.

2. End active sessions. Blocking sign-in does not always remove someone who is already signed in. A browser they left open, a phone with the mail app running — those can keep working. Sign the account out of everything, everywhere. In Microsoft 365 this is a separate action from blocking, and it is the step people miss. Even then it is not quite instant: access that was already granted can keep working for up to about an hour.

3. Reset the password. Not to lock them out — sign-in is already blocked. This is so that a saved password on a home laptop or a personal phone stops silently working if the block is ever lifted or misapplied.

4. Decide what happens to the mailbox, before you touch it. Convert it to a shared mailbox so a manager can read it. Forward it. Hand access to someone. Pick one and do it deliberately. In Microsoft 365, a shared mailbox under a certain size does not need its own paid license, which makes this cheaper than most people expect.

5. Move file ownership to someone who still works there. Files owned by that account need a new owner. This is the step that gets skipped and then discovered eight months later, when the person who owned the pricing spreadsheet has been gone since spring.

6. Deal with devices. Company laptop returned and wiped. Company data removed from any personal phone. More on that below, because it is harder than it sounds.

7. Release the license — last. Releasing a paid license before you have dealt with the mailbox and the files can make both inaccessible. The saving is real but small, and it will still be there in a week. If there is any chance of a dispute, keep the license. An unlicensed shared mailbox is capped at 50 GB and cannot be put on legal hold.

Steps one through three take about five minutes and remove almost all of the risk. If you only have five minutes on the day, do those three and come back to the rest.

The four things almost everyone forgets

The steps above are the ones people know about. These are the ones that surface six months later, usually at the worst possible moment.

1. Shared logins that only they knew

The account with the phone company. The billing login. The social media profile. The domain registrar — the thing that owns your website address.

In small businesses these are routinely held by one person, in their head or in their own password manager. When they leave, that access leaves with them. Sometimes politely. Sometimes not.

The fix is not technical. It is writing down which shared logins exist and who holds them, before anyone leaves. A single document. It does not have to be sophisticated to be the difference between an inconvenience and a crisis.

The worst version of this is the domain registrar, because losing control of it can mean losing your website and your email address at the same time.

2. Services nobody wrote down

Every small business accumulates these. A scheduling tool one person signed up for. A design service billed to a personal card and expensed. A file-transfer account used for one big client two years ago.

None of it is in your main system, so blocking the main account does nothing to any of it.

Ask departing staff directly: what do you log into for work that isn't on the company list? Most people answer honestly, and most are slightly surprised by their own answer. Ask while they are still cooperative, which is usually before the last day rather than on it.

3. Mail forwarding and inbox rules

This is the quiet one, and it is the one most likely to matter legally.

A forwarding rule set up months ago for convenience can keep sending company mail to a personal address long after the account is blocked. It keeps working because the rule lives on the mailbox, not on the sign-in — so blocking the person does not stop the rule.

Microsoft now blocks forwarding to outside addresses by default, and has done since 2021 — the message bounces back to the sender instead. But plenty of small businesses switched that off at some point, usually because one person needed it for a legitimate reason and nobody switched it back. So check whether external forwarding is allowed in your tenant before assuming it is not. If it is, every rule anyone ever set is still live.

Check for forwarding and for inbox rules before you convert or close the mailbox. Once it is converted, the rules are harder to find.

4. Company data on a personal phone

If someone had work email on their own phone, that data is still on their own phone.

What you can do about it depends entirely on how it was set up. If the phone was enrolled in a device management system, you can usually remove the company data and leave their photos alone. If it was just added as a mail account, you are relying on the sign-in block to make it stop working, and on them to remove it.

Ask, in writing, and record the answer. Sometimes the honest position is that you cannot fully verify it — and knowing that is better than assuming otherwise.

The departure nobody planned for

Most guidance assumes two weeks' notice and a friendly handover. Plenty of departures are not like that. Someone leaves suddenly. Someone leaves badly. Someone stops answering their phone.

You can do more without their cooperation than most people expect.

You can block the account, end the sessions, reset the password, convert the mailbox, transfer file ownership, remove company data from a managed device, and reset any shared login you can recover through its own "forgot password" process using a company email address.

You cannot recover a password held only in their head, remove data from an unmanaged personal device, or regain control of a service registered to their personal email without going through that provider's own process.

Which is the real argument of this lesson. Almost everything that makes an unplanned departure survivable is something you did before it happened.

What to do before anyone leaves

Three things, none of them technical, all of them worth an hour:

Write down the shared logins. What exists, who holds it, and which email address it is registered to. Keep it somewhere the business controls.

Register services to a company address, not a personal one. If your scheduling tool is registered to someone's Gmail, it belongs to them in every practical sense.

Make sure at least two people can get into anything that matters. The domain registrar, the bank, the main email system. Not because you distrust anyone, but because people get sick, go on vacation, and leave.

A checklist you can actually use

Print this, or keep it where you will find it at four o'clock on a Friday.

Within the first ten minutes

• Block sign-in
• End all active sessions
• Reset the password

Within the first day

• Check the mailbox for forwarding and inbox rules
• Decide what happens to the mailbox, and do it
• Transfer ownership of their files
• List any shared logins they held

Within the first week

• Collect and wipe company devices
• Remove company data from personal devices, or record that you could not
• Reset shared logins they knew
• Check for services registered to their personal email
• Release the license

If there is any dispute

• Change none of the above except the first three steps
• Get advice before deleting anything

What to remember

Blocking takes seconds. Deleting is permanent. Do the first immediately and the second never, or at least not this month.

The things that go wrong are rarely the main account. They are the forwarding rule, the shared login, the service registered to a personal email address.

And the single best thing you can do about an unplanned departure is to spend an hour, while nothing is going wrong, writing down what exists and who can get into it.