Offboarding is more than disabling email
When someone leaves, disabling their email is necessary. It is rarely sufficient. Shared mailboxes, remote access tools, payroll and banking sites, vendor portals, and devices can keep working under an old login or a password the rest of the team still shares.
Titan reviews leftover logins and unowned admin accounts as part of the work we do with clients. The checklist below is a practical starting point you can use internally. It is general guidance, not a complete security program, and it will not fit every office in exactly this order.
Offboarding access checklist
Use this when an employee, contractor, or vendor relationship ends. Assign one person to own the list, and write down the date each item was completed.
Identity and email
- Disable or block sign-in on the person's primary account the day access should end, not "when someone gets to it."
- Remove them from shared mailboxes, Microsoft 365 groups, distribution lists, and Teams.
- Check mailbox forwarding rules, app passwords, and registered MFA devices.
- Transfer or retain the mailbox and OneDrive files according to your records policy, then remove personal holds that are no longer needed.
- Look for leftover logins: former staff, generic accounts such as info@ or booking@ used as a person, and test accounts that were never turned off.
Admin and privileged access
- Remove admin roles in Microsoft 365, the server, the firewall, the backup console, and any remote-management tool.
- Find unowned admin accounts: a privileged login with no current owner, a shared admin password, or a vendor account that was never revoked.
- Change any shared or break-glass password that person could have known.
- Confirm MFA is still enforced on every remaining admin account.
Remote access, devices, and building entry
- Revoke VPN, remote desktop, and any unattended remote-access tool.
- Collect or remotely lock laptops, phones, tokens, security keys, and storage devices.
- Remove the person from Wi-Fi, VPN groups, and saved personal hotspots if those were issued.
- Update badge, alarm, and door-code access if your office uses them.
SaaS apps, vendor portals, and passwords
- Remove access to payroll, banking, bill pay, accounting, CRM, HR, and document-signing tools.
- Remove access to vendor portals, shipping accounts, social media, and domain or website registrars.
- Check the company password manager for entries they owned, and move those entries to a current owner.
- Review personal devices that may still have a company email profile or saved password.
After the first day
- Confirm the account cannot sign in, and that a leftover mailbox or alias is not still delivering mail to them.
- Watch for unexpected MFA prompts or sign-in attempts on related accounts for a short period after they leave.
- Update your offboarding record so the next departure does not depend on memory.
If you cannot tell who still has access, that is a finding, not a paperwork issue. Write it down and close it.
How Titan can help
Titan reviews leftover logins and unowned admin accounts, and we handle day-to-day onboarding and offboarding for the Microsoft 365 environments we manage. If you are not yet a Titan client and you want a starting picture before you change providers or tighten access, we offer a free 30-minute IT and access review that ends in written findings.
This checklist does not guarantee that every account has been removed, and it is not a substitute for your own legal, HR, or records obligations.
Titan IT Management is locally owned, family- and veteran-owned, and based in Stuart, serving the Treasure Coast and northern Palm Beach County.