When a staff member leaves: an account access checklist

Short answer: Close a leaver's access on their last day, in this order: the main work account (Google Workspace or Microsoft 365), shared passwords, anything they "own" outright such as the domain registrar, social pages or Google Business Profile, then payments and devices. Transfer their files and email to a colleague before you delete anything, because both Google and Microsoft give you only around 20 to 30 days to change your mind. Prepare the list in the week before they go so the day itself takes an hour, not a week.

Why small businesses get this wrong

In a ten-person business, the person leaving is often the one who set things up. They registered the domain with their own email, made the Facebook page from their personal profile and are the only admin on the ad account. None of that shows up in an HR checklist. It shows up three months later when the domain renewal email goes to an address nobody reads.

The checklist below is grouped by system, then sequenced by timing. Copy it, delete what doesn't apply and add your own tools.

Before they leave (the week before)

Build their access list. Ask them, and check yourself: which logins, which admin roles, which accounts were registered with their email or phone number.
Find single points of failure. Anything where they are the only owner or admin: domain registrar, hosting, website admin, Google Business Profile, Meta business assets, ad accounts, app store developer accounts, accounting software, bank and payment portals.
Add a second owner now, while they can still approve it. A Google Business Profile, for example, can have several owners but only one primary owner, and Google notes there must be at least one other owner or manager before primary ownership can be transferred.
Move "personal" ownership. Change account emails from their address to a role address (admin@, accounts@) that you control.
Ask them to move work items out of private storage. 1Password's business guidance, for instance, suggests creating a shared vault and asking the person to copy items from their own vault into it before they're suspended.
Agree a handover: open jobs, client contacts, recurring tasks, scheduled posts and automations running under their account.

On the day

Main work account

Google Workspace: don't delete the account first. Per Google's admin help (as of November 2026), when a user is deleted, data that isn't transferred is deleted; super admins can transfer some data during deletion, other admins must transfer it beforehand, and some data is kept for 20 days during which the user can be restored. Before transferring data for a user you've already deleted, you have to restore them within that window. If you want to keep their data without paying for a full account indefinitely, look at suspending or archiving.

Microsoft 365: Microsoft's "remove a former employee" series runs in this order: block sign-in, save the mailbox contents, wipe and block their mobile device, forward their email or convert the mailbox to a shared mailbox, give a colleague access to their OneDrive and Outlook data, then remove the licence. After deletion, OneDrive and Outlook content is kept for 30 days, during which the account can be restored.

Either way:

Reset the password and sign them out of all sessions.
Remove their authenticator app or phone as a second factor.
Forward or redirect their email so customers' messages still reach someone. Set an auto-reply that names the new contact.

Shared passwords and the password manager

Suspend or remove them in the password manager.
Change the password of every shared item they could see, starting with banking, email admin, domain and hosting.

Website, domain and hosting

Remove their user from the website admin (WordPress, Shopify, Wix, etc.) or downgrade them.
Check the domain registrar: account owner, registrant email, and who receives renewal notices.
Remove or rotate their access to hosting, DNS provider, CDN and any SFTP or SSH keys.

Social, ads and listings

Remove them from Facebook/Instagram business assets, LinkedIn page admins, TikTok and YouTube channel roles.
Remove them from Google Ads, Meta Ads and any other ad accounts; check the payment method on file isn't their card.
Google Business Profile, Apple Business, review sites: remove them as owner or manager once someone else holds ownership.

Money

Revoke bank, payment provider (card terminal, online payments) and accounting software access.
Cancel company cards in their name; reassign subscriptions billed to those cards.

Devices

Collect laptops, phones, security keys and building access cards.
Wipe company data from personal phones that had work email or apps.
Check that files saved only locally have been copied to shared storage before wiping.

After they've gone (first month)

Week 1: watch for bounced or unanswered emails and missed renewals. Check that automations running under their account (scheduled reports, Zapier or Make workflows, form notifications) still work.
Week 2: confirm transfers worked: the colleague can open the files and the mailbox.
Week 3–4: delete or archive the account once you're sure nothing is missing, keeping in mind the 20- or 30-day restore windows.
Update your access register so the next offboarding starts from an up-to-date list.

Keep a simple access register

The best offboarding is prepared long before anyone resigns. A one-page register of every system, its owner, its admins and the email it's registered to turns the "before" section into a ten-minute review. Add to it every time someone signs up for a new tool. If you also want a safety net for deleted mail and files, see whether your Workspace or Microsoft 365 data needs a backup.

FAQ

Should we delete the account straight away?

No. Transfer data first, then suspend or block sign-in. Delete only once you've confirmed nothing is missing, and remember the restore window is short.

Can we keep their email address working?

Yes. Forward it to a colleague or, on Microsoft 365, convert it to a shared mailbox. On Google Workspace, the address can be routed to a colleague; check Google's admin help for the current options before you remove the account.

What if they're leaving on bad terms?

Do the "on the day" section at the moment you tell them, not after. Block sign-in and change shared passwords first, then handle the handover.

What about contractors and agencies?

Treat them the same way. Agencies often hold admin access to your website, ads and analytics long after the project ends.

If your website, domain or hosting is still tied to someone who's moved on and you need it brought back under your control, let us know what you can still log in to.