How to Safely Offboard an Employee (and Protect Your Company Data)

When someone joins your business, everyone remembers to set them up. When they leave, offboarding is often an afterthought — and that's exactly where businesses get caught out. A departed employee who still has access to email, files and cloud apps is a live security risk, whether they left on good terms or not. Add a lost laptop or a mailbox nobody thought to preserve, and a routine resignation can turn into a data breach or a lost-knowledge headache.

Here's a practical checklist for offboarding a staff member safely — protecting your data on the way out, without disrupting the rest of the team.

Why offboarding matters more than people think

The risk isn't only a disgruntled ex-employee. It's also the forgotten account: the mailbox still receiving customer enquiries, the shared login nobody rotated, the personal phone that still syncs company email months later. Attackers actively target dormant accounts precisely because no one is watching them. And under the shared-responsibility model, your data protection is your responsibility — not something Microsoft or Google does for you automatically.

Good offboarding closes every door the person had access to, and preserves anything the business needs to keep.

The offboarding checklist

Ideally this happens on the person's last day (or the moment a departure becomes involuntary), in roughly this order:

1. Disable the account first — don't delete it. Blocking sign-in immediately cuts off access while preserving the mailbox and files. Deleting straight away can destroy data you still need.
2. Sign the user out everywhere and reset the password. Revoke active sessions and tokens across Microsoft 365 / Google Workspace so an already-open session can't keep working. Re-registering multi-factor authentication removes their authenticator too.
3. Convert the mailbox and keep the email flowing. Convert their mailbox to a shared mailbox (or set delegate access / forwarding) so client emails still land somewhere and nothing is missed. Set an auto-reply if appropriate.
4. Reassign their files and data. Transfer ownership of their OneDrive, and check they weren't the sole owner of any SharePoint sites or shared documents. This is also where a proper third-party backup of Microsoft 365 earns its keep.
5. Remove and wipe devices. Retrieve company laptops and phones. For any company or BYOD device managed in Microsoft Intune, remotely remove the company data — on a personal phone you can wipe only the work data, leaving their photos and apps untouched.
6. Revoke third-party and app access. Don't stop at email. Xero, your CRM, the password manager, banking portals, social media, VPNs, remote-access tools, building/door access — anywhere the person had a login. Shared passwords they knew should be rotated.
7. Reclaim the licence. Once data is safely reassigned, remove or reassign the Microsoft 365 / software licence so you're not paying for a seat nobody uses.
8. Document it. Record what was disabled, transferred and revoked, and when. If anything ever comes into question, you have a clean trail.

The mistakes we see most often

• Deleting the account on day one — and losing years of email or files the business needed.
• Forgetting the "other" logins — the mailbox gets locked, but the ex-employee still has access to the CRM, a shared social account, or a VPN.
• Not rotating shared passwords — if several people used one login, changing it is the only way to actually revoke the person who left.
• Leaving personal devices connected — a phone that still syncs company email long after someone's gone.
• No preservation plan — auto-deleting a mailbox that was the only record of a client relationship.

How we make offboarding safe and simple

For our managed IT clients, offboarding is a documented, repeatable process — you tell us someone's leaving, and we run the whole checklist: block access, preserve the mailbox and files, wipe devices, revoke third-party logins and reclaim the licence, with a record of exactly what was done. It's one of the quiet advantages of proactive managed security: the risky moments are handled properly every time, not left to whoever remembers.

If your business doesn't have a solid offboarding process — or you've got a departure coming up and want it done right — get in touch with the Computer Mechanics team or call (08) 9325 1196. We've been keeping Perth businesses' data secure since 1997.