When an employee leaves, most small businesses remember to collect the laptop. Far fewer remember the Microsoft 365 session still open on the person's phone, the bank portal login, the shared Wi-Fi password, or the vendor accounts registered to their email address. Every one of those is a door left open.
A clean IT offboarding takes about an hour if you follow a fixed order. The order matters: if you delete the account before saving the mailbox, the email history goes with it. Below is the sequence we use for clients in Miramar and across Broward County.
Before the last day: build the access list
You can't remove access you don't know about. Before the departure, list everything the person can get into. Most small offices find more than they expected:
| Category | Examples |
|---|---|
| Core accounts | Microsoft 365 or Google Workspace, computer login, VPN |
| Business applications | Accounting (QuickBooks), CRM, practice-management or POS software |
| Money and payroll | Online banking, payment processors, payroll portal, company cards |
| Public-facing | Website admin, domain registrar, Google Business Profile, social media |
| Physical and shared | Door codes, alarm codes, keys, office Wi-Fi password, shared logins |
| Devices | Company laptop, phone, tablet, and any personal phone with company email |
The 7-step offboarding sequence
Do these in order. Each step protects the data the next step depends on.
Step 1: Agree on the exact cut-off time
HR, the manager and IT agree on the date and hour access ends. For a voluntary departure it is usually end of the last day; for an involuntary one it should be while the conversation is happening.
Step 2: Block sign-in and reset the password
Block sign-in to the Microsoft 365 or Google Workspace account and reset the password so the person cannot log in from any device.
Step 3: Sign the account out of every session and remove MFA methods
Revoke active sessions so phones and laptops that were already signed in are logged out, and remove the person's registered MFA methods.
Step 4: Remove access outside the main email account
Disable or remove the person from line-of-business apps, banking portals, payroll, social media, the website admin, VPN, door codes and Wi-Fi. Change any shared password they knew.
Step 5: Collect and secure company devices
Recover laptops, phones, tablets and keys. Remote-wipe company data from personal phones enrolled in the company's mobile management.
Step 6: Preserve email and files before deleting anything
Convert the mailbox to a shared mailbox or give the manager access, forward new email if needed, and move OneDrive or Google Drive files to a manager or a shared location.
Step 7: Reclaim the license and document the change
Once data is preserved, remove the paid license, update the IT inventory and record what was done and when.
Microsoft 365 details worth knowing
Microsoft documents the full process for removing a former employee, including blocking sign-in, saving mailbox contents and reassigning OneDrive files (Microsoft Learn). Two points save most small businesses money and trouble:
- Shared mailboxes don't need a paid license while they stay under Microsoft's size limit (50 GB at the time of writing, per Microsoft), so converting a departed employee's mailbox keeps the email history without paying for a seat.
- Deleted users can only be restored for a limited time: Microsoft retains the account's OneDrive and Outlook content for 30 days after deletion. If you delete an account before saving its files, you are on the clock.
Common mistakes we see
- Deleting the account first. The mailbox and OneDrive files disappear with it once the restore window closes.
- Only resetting the password. Devices already signed in can keep syncing email until the sessions are revoked.
- Forgetting shared passwords. If the person knew the Wi-Fi password or a shared vendor login, change it.
- No record. Without a dated log of what was removed, you can't prove access was cut if a question comes up later.
Onboarding is the other half
Offboarding is far easier when onboarding was done right: accounts created from a standard template, devices registered in an inventory, and access granted through groups instead of one-off permissions. That way removing a person means removing them from a few groups, not hunting through every app. Account setup and removal for new hires and departures is part of The Techie Guy's managed IT plans; see what is included in managed IT services.
Need someone to handle a departure today?
The Techie Guy handles employee offboarding for Miramar and Broward County businesses, from blocking access to preserving the mailbox and recovering devices. One-time help is $125 per hour; it is included in our managed plans.
Get Help on WhatsAppA departure doesn't have to be a security risk. If your business needs a hand with an offboarding, or wants a standard process for the next one, The Techie Guy can help in English or Spanish. Call 786-481-9288 or message us on WhatsApp.
Frequently Asked Questions
What is the first IT step when an employee leaves?
Agree on the exact cut-off time with HR and the manager, then block sign-in and reset the password on the Microsoft 365 or Google Workspace account at that time.
Is resetting the password enough to remove access?
No. Phones and laptops that were already signed in can keep syncing until you revoke the active sessions and remove the person's MFA methods.
How do I keep a former employee's email without paying for a license?
Convert the mailbox to a shared mailbox. Microsoft 365 shared mailboxes do not need a paid license while they stay under the 50 GB size limit.
How long can a deleted Microsoft 365 user be restored?
For 30 days. Save the mailbox and OneDrive files before deleting the account so nothing is lost when that window closes.
Can The Techie Guy handle offboarding for my business?
Yes. One-time offboarding help is billed at $125 per hour, and account setup and removal are included in The Techie Guy managed IT plans.