Employee Offboarding: Which IT Accounts to Close, and in What Order

On an employee’s last day, HR collects the badge and signs the paperwork. The mailbox, VPN account and cloud admin rights often stay open for weeks. It is the most common security gap we find in small and mid-sized companies, mostly because nobody owns it.

Bad intent is not required. If a former employee’s phone still has an Outlook session, company mail keeps syncing to their pocket long after they join a competitor.

Order matters: what to cut first

Deleting the account should not be step one. Delete it and mail and files can disappear before anyone takes them over. The order we follow:

1. Block sign-in and end active sessions.
2. Hand over data (mailbox, OneDrive, shared folders).
3. Close devices and secondary access (VPN, apps, shared passwords).
4. Remove the licence, and delete the account last.

On Microsoft 365 the first step takes two actions. Blocking the account in the Entra admin center is not enough; you also revoke sessions. A password reset alone does not end open sessions. Even after refresh tokens are revoked, an access token can stay valid for roughly an hour, so for a sensitive departure (a hostile exit, a move to a competitor) do it when the conversation starts, not after office hours.

Handing over data without losing it

Check three things before deleting anything:

• Mailbox: Convert it to a shared mailbox and it keeps up to 50 GB with no licence, accessible to a manager or successor. The mailbox must be licensed at the time of conversion; remove the licence afterwards. Above 50 GB it needs a licence, so large attachments may need cleaning first.
• OneDrive: When the account is deleted, files are kept for 30 days by default (configurable from 30 to 3,650 days) and the manager gets access. The clock starts at deletion; blocking or unlicensing does not start it. Once it runs out, recovering a file you suddenly need becomes hard.
• Forwarding rules: Put a temporary forward or auto-reply in place so customer mail does not bounce. But list existing rules too. A rule left on the old mailbox may already forward everything to a personal address.

The forgotten access points

Area	Why it gets missed	What to do
Phones and tablets	Company mail on a personal device	Wipe company data only through device management (Intune or similar); otherwise have them remove the account
VPN and remote desktop	Separate user on the firewall	Check local users and certificates on the firewall
Shared passwords	One shared login in the vault	Change the password, revoke vault access
Cloud admin panels	Domain registrar, hosting, e-invoicing, accounting software	Check the user list in each
Third-party app consents	User clicked “Sign in with Microsoft”	Revoke app consents and personal access keys
Wi-Fi key	Everyone uses the same one	Change it if the leaver knew a lot

In small offices the domain registrar account is often tied to the leaver’s personal email. Losing that account means losing email delivery. Get ownership moved to a shared address before they go.

A short checklist for every departure

• Account blocked, sessions revoked
• Multi-factor methods removed (no personal phone left registered)
• Mailbox handed over, forwarding rules reviewed
• OneDrive content passed to the successor
• Laptop returned, data taken before the disk is wiped
• VPN, firewall and remote access accounts closed
• Shared account passwords changed
• Licence removed, deletion date put in the calendar

Tie it to a written form every time. The biggest problem between HR and IT is that the departure never reaches IT. Even in a 20-30 person company, adding an IT line to the HR exit form fixes most of it.

Frequently asked questions

How long should a leaver’s email be kept? There is no single legal period. Commercial record-keeping rules for business correspondence apply, and for personal data you follow your own retention and destruction policy (under Türkiye’s KVKK data protection law). In practice, converting to a shared mailbox and keeping it accessible for 6-12 months works for most firms.

Can’t we just delete the account right away? You can, but undoing it is hard. Block first, delete after 30 days if nobody has needed anything.

Who should run the checklist? IT runs it, HR triggers it. Without an in-house IT team, your managed IT provider should have a standard offboarding request. Ask in the contract; it is sometimes billed as a separate job.

To put the process in writing or get an inventory of your current accounts, get in touch.