When someone leaves a business, the IT side should be a short, calm list. Often it arrives as an urgent email instead, because the person has already gone.
Between 19 August 2025 and 18 August 2026, seven organisations we support sent us 12 requests to close off a staff member’s or volunteer’s access. With replies, that’s 16 tickets and about three and a half hours of work. A few more came in with other wording, like what to do with an ex-employee’s inbox, and aren’t counted here.
Urgent and effective immediately
Four of those 12 requests said “urgent” or “effective immediately” in the subject line. They came from two organisations: a consulting firm, three times, and a charity removing a volunteer’s access.
“Effective immediately” usually means the person finished today, and sometimes it means the business is worried about what they could still get into. Telling us straight away is the right instinct. The time to plan the order is before you need it.
The order we’d close things in
This is the order we’d suggest for most small businesses. The first steps matter most when a departure isn’t friendly.
- Sign-in. Block the Microsoft 365 account and sign the person out of every session, so a phone or home laptop that’s still logged in stops working. Remove their multi-factor sign-in methods.
- Email. Decide who needs the mailbox. Converting it to a shared mailbox, or forwarding it to a manager, keeps customer emails from going unanswered.
- Shared passwords. Change anything they knew that isn’t tied to their own account: supplier portals, bank logins, social media, the wi-fi. A business password manager turns this into a list instead of a guess.
- Devices. Collect laptops, tablets and phones, and wipe anything that could still hold company data.
- Phones. Reassign or remove their extension and mobile phone app, and update any voicemail or call routing that pointed at them.
- Files and licences. Move files they owned somewhere the team can reach, then release the licence so you stop paying for it.
What gets missed when IT isn’t told
The steps that slip are the ones that don’t live in the main account. A shared password on a sticky note. A supplier portal login under the person’s email address. A phone app still signed in on a personal mobile. An extension still in the after-hours ring group.
None of those shows up when you look at the list of Microsoft 365 users. They only get closed if someone knows they exist.
The hour someone leaves on bad terms
If the departure is sudden and unhappy, ring us first, then work through steps 1 and 3 before anything else. Blocking sign-in takes minutes. Changing bank and supplier logins usually needs someone inside the business, so keep that list ready.
When things are calm again, finish the rest in order.
Put IT on the exit checklist
Most businesses already have an exit checklist for payroll and keys. Add one line: “Tell IT the last working day and who gets the mailbox.” Send it the day notice is given, not the day they walk out.
If you’d like us to review your exit steps with you, get in touch.