Remove staff access without losing business records

Offboarding needs one owner

A departure affects more than the employee's main email account. It can involve cloud applications, remote access, shared passwords, devices, customer records, physical access and delegated administration. Assign one coordinator and an agreed effective time for access changes. The timing should be directed by the appropriate management or HR process, especially for sensitive departures.

The ANAO's guidance on separating personnel highlights the importance of managing ICT access for both staff and contractors. Its public-sector context is not a claim that your business has identical obligations. The practical lesson is to use an inventory and verify removal, rather than assuming one system contains every account.

Prepare the access inventory

List systems from the subscription register, identity platform, password manager, asset register and the person's role. Include less visible services such as website administration, social accounts, domain registration, payment platforms, integrations and supplier portals. Identify accounts the person created using a business address but outside central administration.

Record the access type and required action: suspend login, revoke sessions, remove a delegated role, rotate a shared secret, transfer ownership or recover a device. Do not put passwords or recovery codes in the checklist itself. A record that an action is required is useful; a spreadsheet full of secrets creates another exposure.

Preserve what the business needs

Agree who will receive ongoing customer work, shared files, mail and calendar responsibility. Use the platform's supported process for retaining or transferring records. Deleting an account before checking ownership can break automations, remove useful history or leave files inaccessible. Avoid leaving an active personal login simply because nobody has planned the transfer.

Check legal, employment, privacy and record-retention questions with appropriate advisers. Do not assume unrestricted inspection of every personal or business message is appropriate. The ATO's cloud guidance advises keeping access to required records before changing services; the same practical caution applies when an account holds essential financial information. Retain usable records through an authorised process.

Carry out the timed change

At the authorised time, disable relevant access and revoke existing sessions using the service's supported controls. Remove remote access and administrative privileges, then review recovery email addresses, phone numbers and MFA methods. Rotate shared credentials the departing person knew where appropriate. A changed password does not always terminate every session or third-party token.

Recover business devices, keys, access cards and security tokens. Record asset condition and who took custody. For personally owned devices, use the agreed policy and qualified advice rather than improvising deletion. Separating business data from personal data can be complex, particularly where the organisation never established device management or a clear agreement.

Verify dependencies after removal

Test important integrations, shared inboxes, scheduled jobs and customer handovers. Check whether the departing person's account owned a form, dashboard or automated process. Review delegated access held by suppliers as well as direct staff logins. A supplier relationship ending can leave the same kinds of access gaps as an employee departure.

Have a second authorised person review high-impact actions, such as banking, domain control and administrator access. Keep a dated record of completion and unresolved items. Recheck the next invoice for removable licences, but do not cancel storage or retention arrangements without confirming the records remain available. Financial savings are a later step, not the first priority.

Keep a practical decision record

Give every unresolved offboarding item an owner and a deadline. If an account must remain for retention or a technical dependency, record the reason, restrictions and review date rather than leaving it active without explanation. Keep licence decisions separate from access decisions: retaining necessary records does not automatically require a former worker's interactive login. Review the completed checklist with the manager responsible for the person's work. That final check can uncover a supplier portal, customer handover or shared device that a central administration export did not reveal.

Build it into normal operations

Maintain role-based onboarding and offboarding checklists so each departure is not a fresh investigation. Review access when people change roles, not only when they leave. Limit routine administrator privileges and shared accounts, which makes future removal easier to verify.

Use the account security checklist to track high-priority controls, and the subscription audit for seats after the access and records work is complete. A successful offboarding outcome is documented removal of unnecessary access, continuity of required records and clear ownership of ongoing work. It is not simply an email account marked deleted.