Sign-in & active sessions
Follow the identity provider's current offboarding instructions to block sign-in and revoke sessions. Blocking sign-in alone may not immediately end every existing session.
Staff departures · Practical guide
When someone leaves, who removes their access?
A staff departure involves more than switching off an email address. Plan access, equipment and business information together, with the departure manager's approval.
The aim of the handover
Access ends.
The work carries on.
Agree both sides of the departure. Removing access and preserving useful business information need to be planned together.
Approved departure planNamed owner · agreed time
End their access
Accounts, sessions, applications and shared credentials.
Confirm each systemHand over the work
Business records, ownership, enquiries and equipment.
Confirm the next ownerBefore their last day
Agree the plan
before changing access.
Confirm the authorised departure time, who approves each action and a named person responsible for the handover. In sensitive situations, coordinate timing privately with management.
Your preparation list
- Authority & timing
- Who approves the work? When should each access change happen?
- Accounts & equipment
- List work accounts, devices, shared mailboxes, applications, cloud storage, VPN and physical access.
- Ownership
- Include business services registered to the person's address, and agree who takes responsibility next.
- Business information
- Agree who needs access to records and how enquiries will be handled. Check contractual, privacy and retention requirements before removing data.
The departure manager sets the plan. IT and each system owner confirm the actions they can carry out.
At the agreed time
Work through
every way in.
Closing an email account is only one part of removing access. Keep a record of the systems checked and the actions completed.
Follow the provider's sequence
Other apps & shared access
Remove access to third-party applications, shared accounts and remote access. For shared credentials, arrange an authorised rotation and identify who depends on them.
Equipment, keys & tokens
Recover business equipment, keys and security tokens. Record what was returned and any items needing follow-up.
For Microsoft 365, use Microsoft's sign-in and session guidance; timing and steps depend on the environment.
After departure
Finish with
a confirmed handover.
Check that the business can keep working, and that every system owner has confirmed their part.
Give the right person access
Arrange approved access to business email and files. Transfer ownership of shared resources and document any forwarding or automatic replies in line with your policy.
Check before removing licences or data
Review the consequences for mailbox contents, OneDrive data, retention and recovery. Deleting an account or licence too early can make the handover harder.
Close the outstanding items
Confirm each system owner's steps, follow up missing equipment, and update the asset register, emergency contacts and documentation.
If something is still outstanding, record what, who and the next action. Keep it visible until it is resolved.
A small-office example
One person leaves.
Several owners help.
A five-person practice needs to cover Microsoft 365, its practice software, alarm access and a shared booking tool.
The manager authorises the departure time. IT coordinates work access, while the relevant owners arrange records, equipment and the remaining systems.
Illustrative scenario and planning sheet, not a Wayrest client case study.
Departure handoverExample planning sheet
- Accountable person
- Practice manager
- Start condition
- Authorised departure time
Work accountsIT providerConfirm access changes
Practice recordsApproved colleagueConfirm the handover
Alarm & booking toolSystem ownersConfirm separate access
Devices & keysPractice managerRecord returns
Keep the instructions close
Further reading
Need a hand with your business IT?
Tell us what you need and we can discuss a suitable next step.