That Friday goes fine.
Someone hands back a laptop, a key fob, and a phone. You block sign-in. You convert the mailbox to a shared one so the invoices and the supplier emails keep arriving somewhere. You pull the license so you stop paying for a seat nobody sits in. By 4:30 it looks handled.
Then the supply house password turns out to be something only she knew. The office manager spends part of Monday on the phone, proving to a stranger in a call center that yes, this really is the company.
Two jobs that look like one
Microsoft's own instructions for converting a mailbox include a line worth reading twice: if you don't reset the password, the original username and password will continue to work on that shared mailbox after the conversion is finished. The same page tells admins to take extra steps to make sure the person can't sign in anymore.
So it isn't one job. Blocking sign-in is one. Resetting the password is another. Converting the mailbox is a third. Removing the license is a fourth. A small business usually does the one that shows up on a bill and calls the rest done.
Thirty days, then gone
Pull the license and Microsoft keeps the mailbox contents for 30 days. After that, email, contacts, and calendar are deleted permanently. Delete the account itself and the OneDrive and Outlook content sits in a recoverable state for 30 days as well.
Thirty days is not very long. The quote from three winters ago. The customer's delivery instructions. The drawings attached to an email thread nobody thought about at the time. If you might need any of it, convert the mailbox to shared and leave the account in place, because the mailbox uses that account as an anchor and won't survive without it. The same goes for forwarding, which only passes along new mail and leaves the history behind.
The passwords that were never in your email
Email is the easy part, because email has an admin center. Everything else doesn't.
The supply house login. The insurance portal. The state filing site. The alarm code. The shared office@ address that four people use and nobody owns. The card saved in a browser. The account for the scheduling tool someone signed up for in 2019 and never mentioned again.
That list lived in her head, or in her phone's autofill, or on a sticky note in the top drawer. When she walks out, it walks with her. The cost shows up weeks later as a locked account and an afternoon on hold, trying to convince a supplier that you are who you say you are.
What good looks like here is boring. A password manager the business pays for and owns, in the company's name, with a shared vault for the logins more than one person needs. Not a spreadsheet. Not a notebook. Something that outlives the person who set it up.
What Friday should look like
One page, one owner, one date. Written in September, before anyone gives notice, because the week someone leaves is never a good week.
- Block sign-in, then end the sessions already open. A closed password doesn't close a session someone left running on a home computer. - Reset the password anyway, even after sign-in is blocked. - Convert the mailbox to shared, and keep the account underneath it. - Give whoever is picking up the work access to the mailbox, the files, and the calendar. - Cancel the recurring meetings, especially the ones holding a room. - Take back the laptop and remove company data from the phone. - Reclaim the license last, since the mailbox needs one assigned before it can be converted. - Change every shared password the person knew, including the wifi and the door code. - Write down what you did, and when.
The list matters more than the tool
None of that needs new software. It needs a name next to a date and a piece of paper that doesn't care how bad the week was.
The time adds up. Nudge Security, a company that sells SaaS discovery software, surveyed 375 IT professionals in 2023 and found that cloud and SaaS offboarding took about five hours per employee on average. Seventy percent said an incomplete offboarding had caused a business disruption, a security incident, wasted spending, or unauthorized access. That's a vendor surveying its own market, so weigh it accordingly. The direction still holds.
The real question isn't whether your process is tidy. It's whether you could name, right now, every account that the last person who left still had a way into. If you can't, that's the work worth doing this month.