What Should Happen to Employee Accounts When Someone Leaves the Company?

Key Takeaways

• Account access after an employee exits should be revoked on the employee’s final day, not whenever someone finds time to handle it.
• Offboarding is a shared responsibility. HR, IT, department managers, and the employee benefits account manager each oversee a different part of the process.
• A written checklist makes it less likely that an account will remain active simply because nobody knew who was responsible for closing it.
• Shared passwords, email forwarding rules, personal devices, and contractor accounts are among the easiest access points that get overlooked.
• Consistent employee exit procedures help reduce security and compliance risks, particularly in regulated industries.

Why Offboarding IT Access Matters More Than You Think

An employee might hand back their laptop and badge, but that doesn’t mean their access to company systems ends too. An old account can stay open and receive confidential emails, customer data, or internal files long after someone has moved on. That’s why account access after an employee exits needs a proper process, not just an afterthought.

Businesses that use external IT support services should build offboarding into their regular support procedures, so the IT team can prepare in advance, cut off access at the right time, and confirm it’s actually been done.

We’ve spent 30 years at Imagine IT helping organizations stay on top of exactly this kind of thing. And what we’ve found is that offboarding problems rarely come down to IT skills. Usually, IT hears about the exit too late, or there’s no clear record of which systems and accounts that employee could access. So, here’s a guide on how to handle it.

What Actually Happens to an Employee’s Accounts When They Leave

A proper offboarding process does not begin and end with switching off an email account. Several connected tasks need to happen in a planned order:

• Immediate access suspension: Email, network, VPN, and essential application logins should be disabled at the appropriate time on the employee’s final working day. In the case of an involuntary termination, access may need to be withdrawn as the employee is notified.
• Data handoff: Move the employee’s files, shared folders, CRM records, and other work-related information to their manager or another team member. This gives the team access to what they need and prevents important information from being lost when the account is no longer active.
• License and subscription review: Paid software seats should be cancelled or reassigned. Besides improving security, this prevents the company from continuing to pay for unused accounts.
• Password and MFA reset: Credentials for shared mailboxes, service accounts, vendor portals, or other shared systems should be changed. These accounts cannot be secured simply by disabling the employee’s individual login.
• Physical and remote access removal: Building badges, VPN profiles, remote desktop tools, and mobile access should be removed alongside the main business accounts.

How to Build an Effective Employee Exit Procedure?

Many organizations have an offboarding checklist, but it may be saved in one person’s inbox or used differently by each department. In addition to being easy to find, effective employee exit procedures should be clearly assigned and followed consistently.

According to Imagine IT’s consultants, the practical process normally includes:

1. A formal trigger, usually an HR notification sent as soon as a resignation or termination is confirmed.
2. A clear time for disabling email, network access, and other primary accounts.
3. An up-to-date list of the applications and systems used by the employee or their role.
4. A sign-off from IT confirming that access was removed, rather than simply acknowledging that a request was received.
5. An approved retention period for files and email before the account and its data are permanently deleted.

The process should also account for legal holds, records-retention policies, and industry requirements. A healthcare organization, for example, may have different obligations from a construction company or professional services firm.

At Imagine IT, we offer both fully managed and co-managed IT services, with regional teams across Minnesota, Kansas, and Michigan who know their clients’ systems and day-to-day setup inside out. Since our team already has visibility into each client’s IT setup, we’re also well placed to check for accounts, devices, and access that might otherwise get overlooked during employee offboarding.

Who Should Have Account Access After Employee Exits

Offboarding can go wrong when many people are involved without anybody having clear accountability. HR assumes IT has been told. IT assumes someone needs to approve the request first. Nobody actually disables the account, so it just sits there, still active.

A clearer division of responsibility must be like this:

• The HR department confirms the employee’s final working date and promptly informs IT and the relevant manager.
• Besides disabling accounts and removing remote access, the IT team updates shared credentials and handles employee account management across connected systems.
• The employee’s manager reassigns current work and flags any department-specific tools that IT may not know about, such as vendor portals, marketing platforms, or locally purchased applications.
• The employee benefits account manager handles access and communications related to payroll, insurance, retirement plans, and other benefits. These services may follow different timelines from company IT accounts, especially when former employees need continued access to certain documents or benefits information.

Also Read: The IT Support and Cybersecurity Checklist

Common Mistakes That Leave Accounts Exposed

Even organizations that disable the main user account can miss less obvious forms of access. Common examples include:

• Shared logins never get changed: If the departing employee knew a shared password, it needs to be changed, even when the departure was friendly.
• Forwarding rules stay active: An old rule may continue sending company email to an external or personal address after the employee has left.
• Mobile access is forgotten: Returning a company laptop does not remove files, email, or authentication apps from a personal phone or tablet.
• Contractors and temporary staff receive no formal offboarding: Their accounts may remain active since their departure doesn’t go through the usual HR process.
• Third-party applications are missed: Teams sometimes purchase tools directly without involving IT, leaving no central record of who has access.
• Nobody verifies completion: Sending a request to disable an account is not the same as confirming that every access point has been closed.

These gaps are easier to prevent when IT maintains an inventory of users, devices, software, and permissions instead of trying to reconstruct that information after someone announces their departure.

Also Read: How to Create an IT Onboarding Checklist for New Employees

Make Account Access After Employee Exits Part of Your Offboarding Standard

Managing account access after employee exits should be a routine business process, not an improvised response to each resignation or termination. The checklist does not need to be long or complicated. It needs to identify the systems involved, assign each task to a specific person, set clear deadlines, and require confirmation when the work is complete.

A consistent process also makes unusual departures easier to manage. When an employee must leave immediately, HR and IT can act from an established plan instead of deciding what to do under pressure.

If your current offboarding process depends on informal messages or individual memory, Imagine IT can help you review the gaps and build a more dependable approach. Book an IT consultation to discuss how employee access fits into your wider IT and cybersecurity strategy.

FAQs