What Access Rights Should Be Removed When an Employee Leaves?

Published 2026-10-31

Start by revoking the access that can expose everything

When an employee leaves, remove the access that can be used to get into everything else first. That usually means email, password reset access, single sign-on, and any admin accounts. If someone can still open a mailbox, they may be able to reset passwords or reach connected services, which is why CISA and NIST both treat account disablement and least privilege as basic offboarding hygiene, not optional busywork (CISA account and access control guidance and NIST SP 800-53 account management and access control).

In plain English, the “keys to the kingdom” go first. Email is usually the biggest one because it can expose password resets, customer messages, and connected logins. Admin accounts come next, because admin rights are basically the corporate version of a skeleton key.

Revoke access by system, not by role title

Do not assume a job title tells you what to remove. A small business owner or manager should work from an app inventory, because the exact list depends on what that person actually used.

Common places to check include email and calendar, cloud storage and shared drives, accounting and payroll, CRM, file-sharing tools, messaging apps, remote access, domain or website hosting, backup consoles, and any shared credentials or recovery contacts.

This is the annoying part, but it is the part that saves you from the “wait, who still has access to payroll?” moment two weeks later. If the employee touched a system, remove their access there directly.

Remove privileges before deleting the account

Before you disable or delete anything, transfer ownership of business files, inboxes, calendars, and customer records to the right person. Then remove admin rights, API keys, app passwords, recovery emails, and device trust.

That order matters. If you delete first and sort ownership later, you can lock the business out of files, shared mailboxes, or customer data. CISA’s account management guidance and NIST’s least-privilege approach both point toward controlled removal, not a rip-the-bandage-off-and-hope situation (CISA, NIST SP 800-53 Rev. 5).

So the practical sequence is:

1. Transfer what the business still needs.
2. Remove elevated permissions and recovery methods.
3. Disable sign-in.
4. Delete the account only after you know nothing important is stranded behind it.

Check devices and sessions too

Account access is not just a username and password problem. Sign out of laptops, phones, browsers, and VPN or remote desktop sessions. If the employee had access to company data on a device, remove corporate profiles, encryption keys, and saved authentication methods too.

This is the stuff people forget because it is invisible until it bites. A browser still signed into email, or a VPN session that never got kicked out, can keep a door open long after the employee left the building.

Worked example: a departing office manager with email, payroll, and shared-drive access

Say your office manager is leaving. They handled the main inbox, payroll reminders, and the shared drive where vendor files live.

Here is the clean order for a non-technical owner:

1. Identify every system they used, starting with email, payroll, and shared storage.
2. Transfer ownership of the shared drive folders, the office mailbox, and any calendars or records they managed.
3. Remove any admin rights, recovery email settings, and password reset ability.
4. Remove access to payroll, remote logins, and any shared credentials.
5. Sign them out of mail, browser sessions, and any devices tied to company data.
6. Disable the account.
7. Confirm the account no longer works and that the new owner can open the files and inboxes they need.

The check afterward is simple: can the new person get in, and can the departing person still get in? You want one yes and one no.

Quick offboarding checklist for owners without IT

Use this plain-language sequence:

1. Identify every system the employee used.
2. Transfer ownership of files, inboxes, calendars, and records.
3. Remove admin rights, reset powers, and any special recovery access.
4. Disable sign-in.
5. Collect devices and remove saved trust or recovery methods.
6. Confirm the account no longer works.

That is the whole movie. Everything else is a subplot.

Helpful background on why access reviews matter

The FTC’s small-business cybersecurity basics page is useful background because it reinforces the broader habit of limiting access, using strong account protections, and keeping security practices simple enough to actually follow (What cybersecurity basics does the FTC recommend for small businesses?). That matters here because offboarding is closely related to access control.

Helpful background on breach-related account risk

CISA and NIST guidance on account disablement and least privilege help explain the risk of leaving old email access in place after someone departs or after a breach. If an account stays live, it can keep exposing messages, resets, and connected services, which makes the cleanup bigger and the damage wider (CISA, NIST SP 800-53 Rev. 5). In other words, old access has a habit of becoming new trouble.