SmallTeamStack

The Access Teardown: Removing a Former Employee's Access

By the founder (bio) · Updated

Someone just left your company. Whether the parting was friendly or not, the job is the same: within the hour, they should have no working key to anything. Here is the runbook, ordered so that the highest-risk doors close first.

Scope note: this guide covers the common small-business toolkit. Your stack differs; the fix is the inventory in step 0, which turns this from a scavenger hunt into a checklist.

Step 0 — The inventory you should build today (before anyone leaves)

One page per person: every system they can log into, every shared password they know, every device they carry, everything they own (domains, vendor relationships, social accounts). Ten minutes when you hire; an hour saved when they leave. If you’re reading this mid-departure without one — work the list below and write the inventory as you go.

The first 15 minutes

  1. Email first. Suspend the account (don’t delete — you’ll need the mailbox):
    • Google Workspace: Admin console → Directory → select user → Suspend.
    • Microsoft 365: Admin center → Active users → Block sign-in, then revoke active sessions. Suspending kills the password and active sessions, and blocks “reset my password” attacks against every other service, because those resets land in a mailbox they can no longer read.
  2. Password manager. Remove them from your team vault. Their access to shared items must end the same minute email does.
  3. Rotate the passwords they knew. Every shared credential in their vault collections, plus anything you know was shared informally (the “everyone knows the WiFi and the Instagram login” tier).
  4. Remote access. Disable their VPN profile and any remote-desktop tooling.

The first hour

  1. File sharing — Drive/OneDrive/Dropbox: transfer ownership of their files before deleting anything. In Google Workspace, the suspend-then-transfer flow preserves everything; deleting the user first can destroy files they owned in shared drives.
  2. Business apps — CRM, accounting, project management, scheduling, forms: deactivate their seat (this usually also stops the per-user billing — offboarding pays for itself).
  3. Phone/communications — forward their extension, remove them from the company chat workspace.
  4. Devices — collect laptops and phones; if a device is remote, use your platform’s remote sign-out (both Google and Microsoft can log a user out of all devices) and disable it in your device management if you have any.
  5. Payment access — company cards, PayPal/Stripe operator access, banking view access. Talk to your bank about anything they could initiate.

The five things everyone forgets

  1. Third-party app authorizations — apps they connected to the company Google/Microsoft account keep working after the person is gone. Review authorized apps in the admin console.
  2. API keys and webhooks they created with their name on them.
  3. The accounts that don’t use SSO — the vendor portal, the shipping account, the domain registrar. This is where the step-0 inventory earns its keep.
  4. Their personal devices’ saved passwords — you can’t reach those, which is exactly why rotation (step 3) matters more than collection.
  5. Recovery addresses and phone numbers — check that no company account lists their personal email or phone as its recovery method. This one keeps a door open years after departure.

After the dust settles

Make the next one boring

The difference between a one-hour teardown and a month of surprises is the inventory plus a password manager that makes shared-credential rotation a ten-minute job instead of an afternoon. That’s the order to invest: inventory today, password manager this month, and our security stack guide for everything after that.