IT management
What do you do with an account, mailbox and laptop when an employee leaves?
Short answer
On the last working day, block the account and every sign-in, redirect the mail to a colleague and hand over the files before you delete anything. Then collect the laptop and phone, wipe them and cancel the licence. The order matters: close access first, secure the data second, clear up last. Write down who does it, because this work falls between HR and IT.
Why does this go wrong so often?
Because it is nobody’s job. HR handles the contract and the final pay. The line manager handles the handover of the work. The accounts stay where they are until someone happens to think of them.
You see the result in almost every inventory we do: accounts of people who left a year ago and can still sign in. A licence paid for every month for someone who no longer works there. A shared password that the former colleague still knows by heart.
It is rarely ill will. It is a leak that stays open until someone finds it.
What do you do on the last working day?
Close access. That is the step that cannot wait.
- Block the account. Block it, do not delete it yet. Nobody can sign in any more, and the mail and files stay in place.
- Sign out all sessions. A phone or laptop that is still signed in keeps working until the sign-in expires.
- Change shared passwords. The wifi password, the supplier account, the login for the bank that several people can access. With a password manager you see in one go what the leaver had access to.
- Withdraw access outside Microsoft 365. Bookkeeping, CRM, the website admin, the alarm key. This is the part most often forgotten, because it is not kept in one place.
If someone leaves on bad terms, do steps 1 and 2 during the conversation, not at the end of the day.
What happens to the mail?
Business mail keeps arriving at the old address for weeks. There are three tidy ways to deal with that:
| Approach | When |
|---|---|
| Automatic reply with a colleague’s name | Always, as the first step |
| Convert the mailbox to a shared mailbox | When colleagues need to read the old correspondence |
| Close the address after an agreed period | When no business mail arrives any more |
In Microsoft 365 a shared mailbox needs no licence of its own as long as it stays under 50 GB. That way you keep the correspondence without paying for it. The difference with other forms is explained in shared mailbox or distribution list.
And the files?
Hand over first, delete later. Files in a shared place, such as a SharePoint site or a team channel, stay where they are. The risk is in what only lived in the leaver’s personal OneDrive.
Have the line manager go through that folder and move what the company needs. After the account is deleted, Microsoft keeps the OneDrive for a limited time, and then it is gone. A Microsoft 365 backup catches what someone overlooks in that period.
What do you do with the laptop and phone?
Collect, wipe, set up again.
- Check that you have everything back: laptop, charger, phone, access pass, any security key.
- Wipe the device completely. Creating a new user account is not wiping.
- If business mail was on a private phone, remove only the business part. That can be done remotely if the phone is enrolled in management.
With workplace management a wiped laptop is set up again by itself once the next user signs in.
When do you really delete the account?
When mail and files have been handed over and nobody needs anything from it any more. Only then do you remove the licence and delete the user. If you remove the licence on the last working day to save money, you start a clock after which the data disappears.
Write down for each departure what was done and by whom. An insurer or a client who asks about your security wants to see exactly this.
How do you make it a routine?
With one list and one agreement. The list is what you read above, plus the systems only you use. The agreement is that HR reports a departure as soon as it is known, with the last working day.
For clients whose IT management we run, it works like this: the contact person reports the departure, we plan the steps for the last working day and report back what was done. For a new employee it works the same way in reverse.