When a new person joins, everyone is focused on getting them working on day one. When someone leaves, everyone is focused on handing over their work. In both cases, the IT steps tend to happen in a rush, from memory, by whoever is free. That is how a former employee still has email on their phone six months later, or a new hire spends their first week sharing a colleague's password.
A written checklist fixes this. It makes sure the same steps happen every time, in the right order, and leaves a record that shows they did. This article gives you a practical checklist for staff joining and leaving, written for owners and office managers rather than IT specialists.
Why this matters more than it seems
Every account a person holds is a door into your business. When accounts are created in a hurry, they often get more access than they need. When accounts are not closed properly, the doors stay open after the person has gone, whether they left on good terms or not. Former staff accounts that are still active are also attractive to attackers, because nobody is watching them.
There is a privacy side too. The BC Personal Information Protection Act (PIPA) requires organizations to protect personal information in their custody or under their control with reasonable security arrangements against unauthorised access. Federal privacy law under the Personal Information Protection and Electronic Documents Act (PIPEDA) has a similar safeguarding principle. Limiting access to people who need it, and removing it when they leave, is one of the most basic ways to show that.
Before day one: onboarding checklist
Start the IT steps when the offer is accepted, not when the person walks in. A request from the hiring manager should name the person's role, start date, manager and the systems they need.
Onboarding: joining the team
- Written request from the manager, with role, start date and systems needed
- One named account per person. No shared logins and no reusing a former employee's account
- Licences assigned for email, office apps and any line-of-business software, and recorded
- Least access: only the folders, shared mailboxes and apps the role needs. No administrator rights for daily work
- Multi-factor authentication (MFA) set up on the first sign-in, before any work begins
- Password manager account set up, so passwords are never shared by email or sticky note
- Device prepared: updated, encrypted, security software installed, enrolled in management, asset tag and serial number recorded
- Phone rules agreed if the person will use a personal phone for work email
- Policies acknowledged: acceptable use, AI tools, privacy and how to report a suspicious email
- Security awareness training booked in the first weeks
A few points worth explaining
Shared logins. When several people use one account, you cannot tell who did what, you cannot remove one person without disrupting everyone, and the password tends to leak. For a shared inbox such as info@ or accounts@, use a shared mailbox instead. In Microsoft 365, a shared mailbox lets a group read and send from a common address while each person signs in with their own account. Microsoft notes that creating a shared mailbox also creates a user account, and recommends blocking direct sign-in to it.
MFA from the start. Multi-factor authentication asks for a second proof, such as an app prompt, on top of the password. Setting it up on day one is far easier than chasing people later. The Canadian Centre for Cyber Security lists strong authentication among its baseline controls for small and medium organizations. Our multi-factor authentication page explains the options.
Personal phones. If staff read work email on their own phones, agree up front how work data will be protected and removed when they leave. Our article on mobile app security and bring your own device (BYOD) covers this.
Changing roles
People who move between roles often keep their old access and gain new access, until a long-serving employee can see almost everything. When someone changes role, review their access against the new role and remove what they no longer need. A quick review of everyone's access once or twice a year catches what slipped through.
The last day: offboarding checklist
Offboarding should be planned with the manager and, where needed, human resources before the last day. For a planned departure, schedule the access removal for the end of the final working day. For a sudden or difficult departure, remove access at the time the person is told, not after.
Before the last day
Plan the handover
Agree who takes over the person's email, files, calendar items and client contacts. Ask the person to move work files out of personal folders into shared locations. List every system they use, including ones outside Microsoft 365 or Google Workspace, such as banking, accounting, supplier portals, social media and the website.
Last day, at the agreed time
Remove access
Block sign-in to the work account and reset the password. Sign the user out of all sessions and remove their MFA methods so existing sign-ins on phones and laptops stop working. Microsoft's guidance for removing a former employee follows this order: prevent sign-in first, then save the mailbox contents, then wipe and block mobile devices.
Remove the person from shared mailboxes, groups, shared folders and Teams. Change any shared passwords they knew, such as the Wi-Fi password, alarm codes or a vendor portal login, and update the password manager.
Same day
Recover devices and data
Collect the laptop, phone, keys, access cards and security keys, and check them against the asset record. Remove company data from any personal phone used for work. Do not wipe a company laptop until you have confirmed that nothing needed is stored only on it.
Within the first week
Handle email and licences
Decide what happens to the mailbox. Common choices are forwarding new mail to the person taking over, setting an automatic reply that gives a new contact, or converting the mailbox to a shared mailbox so a colleague can keep using it. Give the successor access to the person's OneDrive files if needed.
Then remove the licence so you stop paying for it. Microsoft documents that when a licence is removed or the account is deleted, the mailbox is kept for 30 days and then permanently deleted. Make sure anything you need is kept, and backed up, before that window closes. Our backup and disaster recovery page explains why a separate Microsoft 365 backup matters here.
Keeping records
Records turn good intentions into proof. For each person, keep a short record of what was created, assigned and removed, by whom and when. A simple table works:
| Item | Joined | Left | Done by |
|---|---|---|---|
| Work account and MFA | Created, date | Blocked, date and time | Name |
| Licences | Assigned | Removed | Name |
| Laptop, serial number | Issued | Returned | Name |
| Shared mailboxes and folders | Granted | Removed | Name |
| Other systems | Listed | Each removed | Name |
Store these records with care, because they contain employee personal information. BC PIPA requires that personal information used to make a decision that directly affects an individual be kept for at least one year after that use, and that it be destroyed or made anonymous once it is no longer needed for legal or business purposes. Set a sensible retention period with your advisers and stick to it.
These records are also helpful when a cyber insurer, auditor or client asks how you control access. Our IT security checklist covers the wider set of controls they usually ask about.
Make it the same every time
The checklist only works if it is used every time, for every person, including the owner's family members and long-time staff. Keep it in one place, assign one person to own it, and review it once a year. Most of these steps take minutes. Skipping them can cost far more.
Want Joiners and Leavers Handled Properly?
Hexafusion helps Vancouver and Lower Mainland businesses set up accounts, devices and access the right way, and close everything down cleanly when people leave, with a record of every step. Call us at 604-332-1500 or send us a message.
Contact Hexafusion 604-332-1500Related articles: Lost Microsoft 365 Admin Access · Mobile App Security and BYOD in BC · I Clicked a Phishing Link: What to Do