Offboarding Departing Employees Without Leaving Doors Open

An employee left us a few years back, and three months later I noticed their name still showing as "active" in a billing tool we'd half-forgotten we used. They weren't doing anything malicious. They'd just never been removed. That's the offboarding problem in one sentence: the leaving is loud, the access cleanup is quiet, and quiet tasks don't get done.

Why this gets messy at 15 people

At five people, offboarding is one conversation and one password change. At fifty, you have an IT person who owns it. In between, which is where most of you reading this live, it falls into a gap. The manager assumes someone disabled the accounts. Nobody did. The ex-employee still has their personal phone signed into the company Dropbox, the shared Canva, the Slack workspace, and the CRM. Six SaaS tools, six logins, and you only remembered four of them on the last day.

The real problem isn't security theater. It's that you're paying per-seat for a person who doesn't work there, and one of those seats has the keys to your customer list. Both things are bad. One is just more expensive than the other until it isn't.

The checklist I actually use

Build the list once. Run it every time. Mine lives in a shared doc and gets updated whenever we add a new tool. Here's the shape of it:

• Identity first. Suspend the Microsoft 365 or Google Workspace account. That single action kills single-sign-on access to anything connected to it, which if you've set things up right is most of your stack.
• Forward the email to their manager for 30 days. Auto-reply with the new contact. Don't delete the mailbox for at least 90 days — you will need something out of it.
• The non-SSO orphans. Every tool that has its own login outside of Google/Microsoft. QuickBooks, your CRM if it's older, the bank portal, the domain registrar, the phone system admin, social media schedulers. Reset the password, remove the user, rotate any shared credentials they knew.
• Hardware and 2FA. Laptop back, phone wiped if it was company-owned, and any TOTP codes or YubiKeys they were holding for shared accounts get rotated. If they had a key to the building, that too.
• Billing sweep at day 30. Open every SaaS bill and confirm the seat count dropped. This is where the money leaks live.

Make the list the system

If you do this from memory each time, you will forget a tool, and the tool you forget will be the one that matters. Write the list down. Put it in the same folder as your new-hire checklist, because they're mirror images of each other. Anything you grant on day one should appear on the offboarding list automatically. If a manager asks for a new tool for their team, the rule is they add it to both lists before the purchase goes through. No exceptions, becuase exceptions are how the list rots.

The bigger move, once you have ten or more SaaS tools, is consolidating logins behind Google Workspace or Microsoft 365 SSO so disabling one account closes most of the doors. That's a separate post, but the offboarding list is the forcing function that makes you realize you need it.

If your last departure left you wondering what's still active and what isn't, that's exactly the kind of audit we run for small offices. Drop us a note and we'll help you map it out.

— Alexander @ SBATC