Employee Offboarding Checklist: Revoking Access Properly

Three months after a project manager left, a construction company in Montréal's West Island noticed sign-ins to his Microsoft 365 account from overseas. The account had never been disabled; it was kept around to catch emails from a few suppliers. His password, meanwhile, had been reused on another site and leaked.

No disgruntled ex-employee was involved. Most of the time, the risk comes from a forgotten account, a shared password nobody changed or a personal phone still syncing the company mailbox. Every access that survives a departure is a door nobody is watching.

The fix is a written procedure and a checklist, run every single time someone leaves, whether they resign or are let go. Here it is.

Why a departure is a high-risk moment

In its baseline controls for small and medium organizations, the Canadian Centre for Cyber Security recommends having a process to revoke accounts that are no longer required, such as when an employee leaves. Quebec's Law 25 points the same way: an employee may access personal information only when it's needed for their duties (section 20). When the duties end, so should the access. Outside Quebec, the federal privacy commissioner's guidance on PIPEDA's safeguards principle likewise recommends limiting employee access to personal information on a need-to-know basis.

The risks fall into three buckets:

• Lingering access. An active account, a session still open on a phone, an app token that keeps working.
• Data leakage. Client files copied to a USB key or synced to a personal account in the final days.
• Data loss. An account deleted too quickly, taking an important client's emails with it.

Before the last day: prepare

In a small business, departures are often known two weeks ahead. Use that time to prepare, quietly if needed.

• Inventory the access. Microsoft 365 or Google Workspace, accounting software, CRM, online banking, government portals, company social media, building access.
• Spot special privileges. Admin on anything? Bank signing authority? The only person with the login for the domain name or the website?
• Plan the handover. Who takes over the files, the email, the OneDrive or Drive content?
• Monitor proportionately. In a contentious departure, your provider can watch for bulk downloads or transfers to outside accounts. Frame any monitoring with legal counsel.

Day one: cut off access

For Microsoft 365, Microsoft recommends starting by resetting the password and signing the user out of all sessions. One detail matters: blocking sign-in can take up to 24 hours to take effect, while a password reset works immediately. After sessions are revoked, the user has to sign in again within the hour at most. In Google Workspace, suspending the account blocks access to services while keeping the data.

If you're terminating someone, cut access during the meeting, not after. Coordinate the timing with HR so IT is ready the moment the meeting starts, and keep a short script: which accounts, in what order, and who confirms each step. For a voluntary departure on good terms, you can wait until the end of the last day, but not a day longer.

The complete checklist

Core accounts

• Reset the password and sign the user out of all active sessions.
• Block sign-in (Microsoft 365) or suspend the account (Google Workspace).
• Remove registered MFA methods and app passwords.
• Remove the account from groups, admin roles and distribution lists.
• Disable the account in on-premises Active Directory, if you have one.

Email and files

• Convert the mailbox to a shared mailbox or set up temporary forwarding to the replacement.
• Check for and delete any auto-forwarding rules the employee created.
• Transfer ownership of OneDrive or Drive files before any deletion.
• Remove external shares the employee set up.

Devices

• Collect the laptop, phone, security keys, access cards and physical keys.
• Wipe company data from the personal phone (selective wipe through device management).
• Remove the employee's devices from the list of authorized devices.

Apps and external access

• Disable accounts in cloud apps that don't use single sign-on: CRM, accounting, payroll, design tools.
• Remove online banking access and update signing authorities.
• Remove rights on social media pages, ad accounts and the domain registrar.
• Disable the VPN account and any remote access.

Shared secrets

• Change every shared password the employee knew: Wi-Fi, alarm system, generic accounts, vendor portals.
• Remove the employee from shared vaults in the password manager.

Wrap-up

• Remind them in writing of their confidentiality obligations and the return of documents.
• Have the responsible person confirm the checklist in writing.
• Schedule final account deletion and licence recovery.

A business password manager makes the "shared secrets" section far easier: you can see at a glance which credentials the person had. Our guide to deploying a business password manager explains how to roll one out.

After the departure: retain, then delete

Don't delete the account on day one. Microsoft notes that after an account is deleted, its mailbox and OneDrive content is retained for 30 days, during which you can still restore the account. Recover what you need first.

Then apply your retention schedule. Law 25 requires personal information to be destroyed or anonymized once its purposes are fulfilled, subject to any retention period set by law (section 23).

Finally, if you find out a former employee accessed personal information after leaving, treat it as a possible confidentiality incident and log it in your incident register.

Check that the process actually works

Once a quarter, compare the list of active accounts against the employee list from payroll. Any account without an owner is a problem to fix.

Apply the same logic to role changes. An assistant who moves from accounting to sales shouldn't keep access to payroll files. Without regular reviews, rights pile up over the years, and a single compromised account ends up opening every door. The same goes for interns, contractors and your provider's technicians who move off your account: their departure never goes through your HR, but their access has to go too.

This reconciliation is one of the checks we run in a Microsoft 365 and Google Workspace audit, along with forgotten admin accounts and suspicious forwarding rules. For more on those settings, see our Microsoft 365 security audit checklist.