The Week After Someone Leaves
The short answer: name one access owner, keep a written list of every tool, and run that list on the leaver’s last day. Move shared logins into a vault once the team passes five people, so offboarding becomes two steps instead of fourteen.
Resignations rarely arrive at a convenient moment, and the software side of the exit is almost never the part anyone has planned. The handover meeting covers clients and projects. Nobody opens a list of the fourteen tools that person could log into.
Two weeks later the pattern shows up. An invoice goes out from an account nobody can reach, a scheduling link still routes to a suspended inbox, and a subscription renews for a seat that has no person attached to it.
None of this is dramatic. It is the ordinary cost of never having written down where access lives, and it repeats at nearly every small business that grows past three people.
What Has to Happen in the First Hour
- ● Shared passwords before individual ones
- ● Suspend the identity account, do not delete
- ● Write down what you touched
Start with shared credentials, not with the individual account. Anything the whole team logs into with one password is the fastest thing to change and the easiest thing to forget.
Then suspend the person’s main identity account rather than deleting it. Suspension revokes access immediately, keeps the files and mail intact for handover, and avoids breaking every tool that used that address to sign in.
Write down what you touched as you go. A short note beats memory two months later, when a renewal invoice arrives and nobody can recall whether that tool was closed or just ignored.
Why Deleting the Account Is the Wrong First Move
Deletion feels decisive, which is exactly why people reach for it. The problem is that a work email address is not only a mailbox but also a key that other services accept.
Remove it and every tool that used single sign-on through that address loses its anchor. Password resets bounce, shared documents lose their owner, and any automated report that ran under that identity stops without an obvious error.
There is also the licence question. Some platforms release a seat on suspension and some do not, which decides whether you are still paying for someone who left in March. Google Workspace is one that does not, since it charges suspended accounts at the same rate as active ones.
The safe sequence is suspend, transfer, verify, then delete. Only the last step becomes permanent, and there is rarely a reason to reach it in the first week. Google Workspace lets an admin restore a deleted user for up to 20 days, and after that the data is gone.
Where Access Actually Lives
- ● Admin console covers less than you think
- ● Personal signups are the blind spot
- ● Billing card is the best inventory
Small teams tend to picture access as a single list inside one admin console. In practice it sits in at least five different places, and only one of them is visible to an administrator.
| Where access lives | Typical example | Who can remove it | What breaks if you rush |
|---|---|---|---|
| Identity provider | Google Workspace, Microsoft 365 | Any admin | Sign-in for every connected tool at once |
| Tool-level admin seats | Slack, Asana, HubSpot | Tool owner or workspace admin | Assigned tasks and message history ownership |
| Personal signups on the company card | A trial someone started alone | Only the person, until you find the receipt | Nothing visible, which is why it survives for years |
| Shared logins in a password manager | A courier account, a supplier portal | Whoever holds the vault | Everyone locked out if the password rotates badly |
| Third-party app connections | An add-on linked to Drive or mail | The account holder or an admin policy | Silent data access that outlives the account |
| Payment and billing portals | Stripe, the bank, the card provider | Account owner, sometimes only by phone | Payouts and refunds if permissions are cut blindly |
Two rows cause most of the trouble. Personal signups are invisible in any console, and third-party app connections keep their tokens even after the human stops working here.
The billing statement is the practical answer to both. Every tool that charges you leaves a line on the card, which makes the statement the most honest inventory a small business has. Our guide to auditing SaaS subscriptions and cutting wasted seats covers how to work through it line by line.
The Data That Leaves With the Person
Access is one half of offboarding and ownership is the other. A document nobody can open is as lost as a document that was deleted.
Files in a personal drive belong to that account until someone moves them. Transfer ownership before suspension where the platform allows it, since the process is harder once the account is dormant. The differences between the main storage platforms matter here, and our comparison of Dropbox and Google Drive for business covers how each handles a handover.
Client conversations are the piece people notice last. A shared inbox keeps history where the team can reach it, while a personal mailbox takes six months of context with it when the account closes.
Recurring work is the quiet one. Scheduled reports, automation rules, and calendar invites created by that person often keep running under their identity until suspension breaks them without warning.
Shared Logins and the Password Manager Problem
Every small business has a handful of accounts that cannot be split into individual users. Utility portals, delivery accounts, and older supplier systems are the usual suspects.
These are the accounts a departing employee can still reach from a home computer, because the password lives in their head rather than in a directory. Changing them is quick, and skipping them is the most common gap in an otherwise careful process.
A shared vault turns this from a memory exercise into a list. Rotate the entries that person could see, remove their vault access, and the job is finished in one pass. Our comparison of 1Password and Bitwarden for teams covers what the business tiers do differently.
The same tool solves the recording problem. If shared credentials live in a vault, the answer to “what could they reach?” is a page rather than a guess.
Who Should Do What, by Team Size
- ● Solo owners need a written list
- ● Five to ten people need one owner
- ● Client data raises the stakes
A solo owner with contractors: keep a single written list of every tool a contractor can reach, and rotate those credentials at the end of each engagement. The list matters more than any policy at this size.
A team of three to five: name one person as the access owner before you need one. That person runs the checklist on the last day, and the rest of the team knows to route new tool signups through them.
A team of five to twenty: move shared logins into a vault and connect the main tools to one identity provider. Offboarding then becomes two steps instead of fourteen, which is the point at which the process survives a busy week.
Any business holding client data: treat offboarding as a compliance step with a written record. Client contracts often require it, and our explainer on what SOC 2 compliance means for small business software covers why those assurances are asked for.
A team where someone left months ago: run the whole checklist retroactively rather than assuming it was handled. Old access is the most common finding in a first audit, and closing it takes an afternoon.
When the Departure Is Not Friendly
Most exits are ordinary and the checklist order above suits them. A contested departure changes the sequence, because speed matters more than tidiness.
Here the first move is the identity account, not the shared passwords. Cutting the central login stops the largest number of tools in one action, and the shared credentials follow within the hour.
Resist the urge to delete anything. In a dispute the records inside those accounts are the thing you are most likely to need, and deletion is the one step that cannot be walked back.
Take a note of the time each action happened. That log is dull to write and genuinely useful if the situation later involves a lawyer or an insurer.
The Three Failures That Show Up Months Later
The first is the orphaned automation. A weekly report or an invoice reminder was built under someone’s personal account, and it stops silently rather than throwing an error anyone sees.
The second is the connected app nobody knew about. A tool the person linked to company mail or files keeps its token after the account closes, which is why the third-party access list deserves a look rather than a glance.
The third is the recovery contact. Their phone number or personal address sits behind a critical account, and it surfaces only when a password reset is needed at the worst possible moment.
None of these appear in the first week, which is exactly why the one-month follow-up earns its place in the process.
Billing: The Part That Quietly Keeps Charging
Access closes on the last day and billing does not. Most per-seat tools keep charging until someone removes the seat, and suspension alone rarely does it.
Work through the card statement for the two months after a departure. Anything charging for a seat that no longer has a person is either a refund conversation or a cancellation. The way the vendor prices seats decides how much this is worth, and our look at per-user versus flat-rate SaaS pricing explains why one model punishes forgotten accounts far more than the other.
Annual plans need a calendar entry rather than a decision. The cancellation window usually sits weeks before the renewal date, and missing it costs another full year of a seat nobody uses.
A Thirty-Minute Version You Can Actually Run
Long checklists get abandoned during the exact week they exist for. A short one that gets used beats a thorough one that gets skipped.
Rotate shared passwords first, because that is the only step with a real deadline. Suspend the identity account second, which cuts off the majority of tools in a single action.
Transfer file ownership third, working from the projects that are still live rather than the whole drive. Then open the card statement and mark every line that belonged to that person.
Finally, set a reminder for one month out. That is when the leftovers surface, and a single follow-up catches almost all of them.
The Habit That Prevents the Scramble
The teams that handle departures calmly are not more organised in the moment. They simply wrote the access list down before they needed it.
Keeping that list current costs a few minutes whenever a new tool joins the stack. It turns an unplanned exit from an archaeology project into a checklist someone can run between meetings.
There is a second benefit that shows up on the invoice. A team that knows what it pays for stops paying for seats that belong to nobody, which usually funds the tool everyone actually wanted.
For teams on Google Workspace, the account itself is the biggest line on that list. Our comparison of how to suspend, archive or delete a Google Workspace user explains why suspension keeps billing and how to transfer files before deleting.
FAQ
What should you do first when an employee leaves?
Change the password on the shared accounts that person could reach, then suspend their main identity account rather than deleting it. Suspension cuts off access immediately while leaving the files, mail, and licence intact for handover.
Is it safe to delete a departing employee's account straight away?
Not on day one. Deleting a Google Workspace or Microsoft 365 account can remove the files and mail attached to it, and it also breaks any tool that used that address for sign-in. Suspend first, transfer ownership, delete later.
How do you find software an employee signed up for on their own?
Check the billing card statement, the Google Account third-party access list, and the email inbox for receipts and password reset messages. Most tools nobody knew about show up in one of those three places.
Who should receive the departing employee's files?
Whoever takes over the work, not whoever has admin rights. Ownership transfer should follow the job, otherwise documents pile up in an account that no longer matches any active role.
How long should you keep a suspended account before deleting it?
Long enough to be sure nothing was missed, which for most small businesses means one to three months. Keep a note of the deletion date so a suspended licence does not quietly stay on the bill forever.
Sources
- Google Workspace Admin Help: Suspend a user temporarily — checked 2026-10-01
- Google Workspace Admin Help: Restore a recently deleted user — checked 2026-10-01
Some links may be affiliate links. We may earn a commission at no extra cost to you.
How this article was made: it was drafted with AI assistance from the official sources listed above, and its figures were checked against those pages on the dates shown. It is not based on personal hands-on testing.
Comments
Post a Comment