Small business technology
What to do before a staff member or contractor leaves
A simple offboarding checklist for small businesses without a formal IT department.
What you will learn
You'll know which accounts, devices, files and access points to review before someone leaves.
Before you continue
Do not delete accounts, files or mailboxes until business records and ownership have been checked.
Stop and get help if you are unsure who owns an admin account, whether records must be retained or whether a personal device contains business data.
Start before the final day
Offboarding is easier before access is lost or a device is returned in a hurry. Make a short list of the accounts, devices and files the person uses for work.
Keep the tone practical and respectful.
Split it into two lists
Separate what needs to happen on the last working day, such as disabling logins and collecting devices, from what can happen soon after, such as reviewing shared files or updating public-facing contact details. Trying to do everything at once on a busy final day is often when steps get missed.
Check individual accounts
First separate business-controlled work accounts from the person's personal accounts. For a work account, agree when an authorised administrator will block sign-in. Do not take over, reset or delete a personal account; remove its access to business systems instead. This may include email, cloud storage, bookkeeping, social media, website, point-of-sale or booking systems.
Do not delete an account until you understand what business information is attached to it.
Review shared accounts carefully
Shared accounts are harder to manage because one password may be known by several people. If a shared account cannot be replaced yet, change the password and review recovery details.
Move towards individual accounts where possible.
Transfer important files and ownership
Check that business documents, photos, website assets, customer records and admin ownership are still available to the business.
Before removing a sole administrator, confirm that another authorised business account can manage the service and its recovery details.
Forwarding or copying email should be handled carefully because it may include personal or confidential information.
Collect devices and remove access
Return business computers, phones, keys, backup drives and security tokens. Remove access to remote support tools, cloud storage and password vaults where relevant.
For business-controlled accounts, use the provider's controls to end active sessions and remove the departing person's connected-app and recovery access where supported. Changing a password may not end every session immediately.
If the person used their own device, get advice before wiping or changing anything.
What to expect
You have a practical offboarding list and know which access needs to be changed or reviewed.
Sources and further reading
- Small business cyber security guide · Australian Signals Directorate
Supports avoiding shared accounts and reviewing access when people leave.
- What's the difference between a Microsoft account and a work or school account? · Microsoft Support
Supports distinguishing personal accounts from organisation-managed work accounts.
- Prevent user sign-in and block access to Microsoft 365 · Microsoft Learn
Supports authorised account blocking and session sign-out, with provider-specific access delays.