Removing access when someone leaves: business tools and accounts

The hardest access to remove is the access nobody wrote down. When someone leaves, switch off their access first, then sort out the files and mail the business needs.

This guide is for owners of small UK teams where staff, contractors and suppliers come and go. It sets out what to switch off, in what order, and how to keep the work and records the business still needs. It includes a blank leaver checklist, an equipment record and a hypothetical worked example.

Every product has its own steps, and this guide can't promise that any step removes access instantly. It isn't employment-law or HR advice.

1. Before anyone leaves: keep an access list

You can only remove access you know about. Keep a list of each person's access:

• business accounts, such as email, files and calendars
• tools, such as a CRM, job system, accounts software or project tool
• admin access, such as the website, social media pages or supplier portals
• shared logins that several people use
• devices, keys, fobs and codes
• recovery details: which email or phone can reset a password, and which phone or key approves sign-ins

Our website maintenance checklist includes a regular review of who has access. Our guide to a small operations handbook shows how to record how to request access without writing passwords down.

2. Agree when access ends

Decide the point at which access ends. It's the time the business has authorised, such as the end of someone's last day. It can be earlier if there's a security concern. Write it down, and make sure whoever will remove access knows it.

Access should end at that point. It shouldn't wait for files to be moved, for a handover to finish, or for anyone to find the time.

3. At that point, revoke access first

At the agreed time, stop the person signing in, using each product's own steps. The steps differ between products:

• Microsoft 365. Microsoft's guidance on removing a former employee says the first step to preventing unauthorised access is to reset their password. Admins can also sign the user out of all sessions. Microsoft notes that blocking an account can take up to 24 hours to take effect, and that resetting the password is the way to prevent sign-in immediately.
• Google Workspace. Google's guidance on maintaining data security after an employee leaves lists steps including changing the password, revoking password recovery access, revoking app access tokens, resetting sign-in cookies, and revoking security keys and app-specific passwords. Its guidance on preserving a former employee's data says suspending a user blocks their access to the organisation's Google services.
• Other tools. Follow the tool's own instructions for removing or suspending a user, and check the tool's help pages if you're unsure.

Record what you asked for and what you checked

Asking a system to remove access and confirming that access has ended aren't the same thing. Some changes take time, and sessions on other devices may need a separate step. For each account, record two things:

• Requested: what you did, who did it and when.
• Verified: how you confirmed access had ended, using a check the product itself documents, and when.

A new password working for you doesn't show that the person's existing sessions have ended. If you can't verify removal yet, record it as pending, with who will check and how, and follow the product's guidance until you can.

4. Then keep what the business needs, through admin access

Once access is off, an admin can move or preserve the files and mail the business still needs. The person who left doesn't need their access back for this.

• Microsoft 365. Microsoft's overview for removing a former employee suggests considering giving another user access to the former employee's OneDrive and Outlook content before you delete the account.
• Google Workspace. Google says that if you delete a user without transferring their content to another user, the content is deleted. Transferring after deletion needs the user to be restored within 20 days. Suspending or archiving a user are ways to keep data.

Deleting an account is a separate decision, not an automatic next step. You might suspend or archive an account while you decide, or keep it for records you need. How long you keep anything is a decision for your business, based on why you need it.

5. Shared passwords, recovery details, two-step devices and app access

Some access isn't tied to the person's own account:

• Shared logins. Change the password for any shared login the person knew, such as a social media account or a supplier portal. Where the platform allows it, move to individual logins instead.
• Codes. Change shared codes, such as Wi-Fi or alarm codes, if they knew them.
• Recovery details. Check that no account still uses the person's email or phone to reset a password.
• Two-step devices. Remove their phone or security key from any business account it approves sign-ins for.
• App access. Revoke app passwords or connected-app access linked to their account, using the product's own steps.

6. Equipment and physical access

• Collect equipment, such as laptops, phones, keys and fobs, and record the date.
• Decide what happens to each device through an authorised process, before anything is wiped. Google's guidance mentions both wiping an entire device and erasing only the organisation's data. Which is possible depends on the tool and the device.
• Don't wipe anything the business needs to keep until it's been preserved.

7. Open work

Make sure nothing the person was handling is left without an owner. Reassign each open job or enquiry on the record. Our guide to a simple work queue shows how to record a reassignment.

If the person's email address received enquiries, our guide to shared inboxes for enquiries covers moving that address to a shared set-up.

8. Contractors and suppliers too

The same steps apply when a contractor's or supplier's work ends. The NCSC's guidance on securing your important online accounts covers removing accounts that are no longer needed, including those of suppliers and contractors.

Personal data in your systems is part of this too. Article 32 of the UK GDPR requires security appropriate to the risk, and that anyone acting under your authority with access to personal data processes it only on your instructions. Access that's no longer authorised shouldn't stay open.

9. Use the leaver checklist

1. Copy one leaver access card for each account or tool on the person's access list.
2. At the agreed time, revoke access and record what you requested.
3. Verify that access has ended using the product's own check, and record how and when. If you can't yet, record it as pending, with who will check.
4. Then record what data was kept and where, and the decision on the account.
5. Fill in the equipment card for each item.

Hypothetical example

Hypothetical example only: an invented four-person interior design studio. The people and dates are fictional. It is not a ScalePass client, and not legal or HR advice.

Sam's last day is Friday 13 November. The owner has authorised 17:30 that day as the point Sam's access ends.

The owner and Priya prepared the list in advance and made all five requests at 17:30, the authorised end. The right-hand column shows that a request isn't the same as confirmed removal. Each item stays pending, with someone named to check it, until the product's own check confirms that access has ended. For the shared logins, the new password working for the owner doesn't show that Sam's existing sessions have ended.

Recovery details and two-step devices: Sam's phone was removed as a two-step device on the email suite, and the website's recovery email was confirmed as a business address.

This illustrates the order: revoke first, verify, transfer through admin access afterwards, and decide on deletion separately. It isn't a case study.

Common questions

Should I delete their account straight away?

Not necessarily. Revoke access straight away, then decide about the account. Deleting it can delete its data unless you've moved it first, depending on the product. Suspending or archiving can give you time.

How do I keep their emails?

Through admin access, using your product's own steps, such as giving another user access to the mailbox. The person who left doesn't need to be involved.

What about the shared Wi-Fi or alarm codes?

If they knew them, change them. The same goes for any shared logins.

They used their own phone for two-step sign-in. Now what?

Remove that phone from any business account it approves sign-ins for, and set up a business-controlled method instead.

Do contractors count?

Yes. Anyone whose work has ended and who no longer needs access, including contractors and suppliers.

ScalePass helps service businesses set up controlled access in the tools they already use, so the right people see the right information. If you'd like help putting a leaver process in place, see how we approach connected systems.

In short

Keep an access list before anyone leaves. Agree when access ends, then revoke it at that point using each product's own steps, without waiting for a handover. Record what you requested and verify that access has actually ended. Then keep the files and mail you need through admin access, and decide on deletion separately. Change shared passwords and codes, check recovery details, remove two-step devices and app access, deal with equipment through an authorised process, and reassign open work. Do the same for contractors and suppliers.