When someone leaves, the risk is not the goodbye lunch. It is the access nobody remembered to turn off. This FAQ covers the questions small-business owners ask about IT offboarding: what to disable first, how fast to move, and the accounts that quietly stay open for months.
By The NetSys Group Team
Why does offboarding matter so much?
Because former employees often keep access, and some use it. In one Beyond Identity survey of more than 1,100 people, 83% said they still accessed accounts from a previous employer after leaving, and 24% admitted keeping a password on purpose. Every open account is a door you no longer watch.
What should I disable first?
Start with the keys to everything else: the identity provider. Disable the person's Microsoft 365 or Google Workspace account, which cuts email, files, and any app they sign into with it. Then revoke active sessions and reset the password, so a device that is still logged in does not keep working. Identity first, individual apps second.
How fast do I need to act?
For a planned, friendly departure, finish offboarding by the end of the final day. For a termination or any tense exit, disable access at the moment of, or just before, the conversation. Waiting even a few hours gives a motivated person time to copy files or forward email to a personal account.
Which accounts do owners usually forget?
The ones outside the main login. Think the company bank and payroll portals, the domain registrar, social media, the CRM, cloud storage like Dropbox, tools bought on a personal card, VPN and remote-access accounts, and shared password vaults. A current inventory of who can reach what is the only reliable way to catch these.
What about company data on personal devices?
If staff used personal phones or laptops, company email and files may still sit on them. Mobile device management lets you wipe just the business data remotely without touching personal photos. Without it, you are relying on the departing person to delete company information themselves, which is not a control.
Should I forward their email and files?
Yes, before you delete anything. Convert the mailbox to a shared one or set forwarding so client messages still reach someone, and transfer ownership of their documents to a manager. Deleting an account outright can vaporize files and break automated workflows that depended on it. Preserve, then remove.
Can I automate any of this?
Much of it. When accounts are centralized under one identity provider, disabling that account cascades to connected apps, and a documented checklist handles the rest. This is a core piece of what a managed IT provider does. Our managed IT FAQ explains how that day-to-day account management works.
Do I really need a written offboarding process?
Yes. Memory fails, and the person handling offboarding is often busy covering the empty role. A one-page checklist tied to your account inventory turns a scramble into a routine, and it is exactly the kind of control cyber-insurance reviewers now ask about. It also pairs with the basics in our small-business security controls guide.
Not confident every door closes when someone leaves? The NetSys Group can build your account inventory and an offboarding checklist that runs the same way every time. Request a complimentary review or see our managed IT services.
The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.
Turn insight into action.
Take a free cybersecurity or AI readiness assessment, or book a call with a NetSys engineer — no obligation, no runaround.