Someone's Leaving on Friday: The 30-Minute Access Shutdown That Saves the Rest of Us

Somebody hands their notice in. There's a whip-round, a card, a slightly awkward speech by the kettle. The laptop comes back on the Friday and everyone agrees it went well.

Then, six weeks later, an invoice query lands in an inbox that belongs to a person who no longer works for you. Or a supplier gets an email from an address that looks entirely legitimate — because it is. The account is still live. Nobody switched it off.

Offboarding gets treated as an HR formality with an IT garnish. It is neither. It is a security control, and it is one of the few you can complete properly in half an hour if you have a routine written down before you need it.

The leaver is a live risk, not a paperwork item

An active account belonging to a former employee is a set of keys in a drawer that nobody counts. It can receive password resets. It can sit in Teams groups and SharePoint sites. It can still forward mail. And because it looks normal, it is exactly the sort of thing an attacker likes to inherit — either by guessing the password or by simply buying the credentials from someone who is feeling hard done by.

The goal of the next thirty minutes is not to tidy up. It is to make sure the account can no longer be used, then to work out what it was connected to.

Minutes 0–5: write down who actually has access

Before you touch anything, list the leaver's accounts. Not just the Microsoft 365 sign-in — every system their name is attached to. Accounting software, the CRM, the shared password manager, the marketing platform, the door entry app, the mobile contract, the domain registrar, the card payment portal.

You won't know all of them at minute zero. That's fine. The point is to have a place to write them down as they surface, so the list outlives the panic.

Minutes 5–15: Microsoft 365, in the right order

The order matters more than the speed.

1. Block sign-in on the account. This is the big red switch and it should be first, always.
2. Revoke sessions. Blocking sign-in stops new logins, but existing tokens can keep working for a while. Revoking refresh tokens closes that gap.
3. Reset the password anyway. Blocked accounts get unblocked eventually, usually by someone helpful who doesn't check the ticket.
4. Remove the authentication methods — the phone number and authenticator app tied to the account. Otherwise a former employee can approve a sign-in prompt from their own phone if the block is ever lifted in error.
5. Check inbox rules and forwarding. This is the one people skip. A rule forwarding everything to a personal Gmail takes ten seconds to create and months to notice.
6. Check mailbox delegates and calendar sharing. Anything granted "Full Access" or "Send As" needs removing, including permissions given to other staff members years ago and forgotten.
7. Check OneDrive and SharePoint sharing links the person created. A "anyone with the link" share on a folder of contracts doesn't expire just because they left.
8. Convert the mailbox to shared if someone needs to monitor it, then remove the licence. Keep the mailbox for as long as your retention policy says — and remember the person's name is still on it, so treat incoming mail as something to answer, not archive.
9. Remove them from Teams and distribution groups, and transfer ownership of anything they owned. A shared mailbox nobody owns is a future mystery.

Minutes 15–20: the passwords nobody owns

Shared logins are the weak spot in every small business, because they were designed to be nobody's responsibility. The trade counter login. The Royal Mail account. The shared social media password that three people know and one of them is the leaver.

Rotate them. Not next week — now, while you remember why. And if the leaver was the only person who knew a password, that is not an offboarding problem, that's a finding: move it into a password manager with proper individual accounts behind it.

Minutes 20–25: devices, SIMs and the drawer of old phones

If the laptop or phone is company-owned and enrolled in device management, issue a remote wipe or at minimum a full device lock, and confirm it has actually actioned rather than sitting in a pending queue. If it isn't enrolled, you're relying on the leaver posting it back — so get a tracked courier and a signature.

Mobile: cancel or transfer the SIM, and check whether the number is the recovery phone for any account. A recycled mobile number attached to an old account is a genuine route back in.

The contractor who was never on the payroll

Freelancers, agency contacts, volunteers and the parent who helps with the website all have access and none of them appear on a payroll leaver list. Search your tenant for guest accounts and external sharing, then ask the simple question: who is this, and do we still need them?

Set an end date on guest access when it's granted. It's a two-second field and it saves this entire conversation.

Five minutes of paperwork that pays for itself

Record what you did and when. Date, systems, who signed it off. It takes minutes and it is genuinely useful later — when a supplier asks when access was removed, when your insurer's renewal form asks how you handle leavers, or when something odd turns up in the logs three months down the line.

If it's a bad leaver, change the order slightly

Do the block and the session revoke together, out of hours if you can, and don't announce it by email to the account you're about to disable. Preserve the mailbox rather than deleting it. Check the forwarding rules before you do anything else, because if data has been moved, you'll want a record of it. And if it's serious, get proper advice — that's a conversation for a solicitor, not a helpdesk.

Make it a routine, not a rescue

Write the checklist once, keep it where the person covering the helpdesk can find it, and trigger it the day notice is handed in rather than the day they leave. Add a second pair of eyes: someone who checks the list was actually completed, not just started.

Half an hour now, done calmly, versus a weekend of forensic email later. That's the trade, every time.