Staff Onboarding and Offboarding: Getting IT Access Right as People Join and Leave

Some links on this page are affiliate links: if you sign up or buy through them, Dacros may earn a commission, at no extra cost to you. We only recommend tools we use and rate. Full disclosure.

Access is something you hand out — and have to take back

When a new person joins your business, you give them keys: an email account, a login to your systems, access to shared files, maybe the booking software or the accounts package. When they leave, all of those keys need to come back. That sounds obvious, yet the taking-back is where small businesses slip up most often — quietly leaving former staff with live access to company systems long after their leaving do.

Getting this right isn’t about bureaucracy. It’s about making sure the right people can reach the right things while they work for you, and nothing at all the moment they don’t. The good news is that both sides of the job — onboarding and offboarding — come down to a simple, repeatable checklist. Once you’ve written it, you run it every time and the guesswork disappears.

Onboarding: give enough, and no more

The temptation with a new starter is to grant broad access ‘to save hassle later’. Resist it. The safer approach is least privilege: give people access to exactly what their role needs, and add more only when there’s a reason. If a single account is ever compromised, least privilege is what stops one breach becoming a company-wide one.

A clean onboarding runs roughly like this:

• Create individual accounts. Their own email and their own logins — never a shared one passed around the team.
• Grant role-based access. Match access to the job. A receptionist and a finance manager should not have the same reach into your systems.
• Turn on multi-factor authentication from the start. MFA should be set up on day one, not bolted on later. It’s the strongest single protection against stolen passwords.
• Set them up with a password manager. Hand over any credentials securely and get them generating strong, unique passwords from the outset. A shared tool like Proton Pass lets you provision logins to a new starter and — crucially — take them back later, without passwords ever being emailed around or written on a notepad. Our password manager guide covers how to choose one.
• Write down what you granted. A short record of who has access to what is the thing that makes offboarding painless. It’s also exactly what you’ll wish you had if something ever goes wrong.

That last step is the quiet hero of the whole process. You can’t reliably remove access you never recorded granting.

Offboarding: the day someone leaves is the day it matters

Offboarding is where good intentions go to die. Departures are busy and often awkward — handovers, final projects, sometimes hurt feelings — and IT access is the easiest thing to forget. But a forgotten login doesn’t forget you. It sits there, live, as a dormant account: nobody’s watching it, and it’s one of the tidiest ways for an attacker (or a disgruntled former employee) to get in.

A forgotten login doesn’t forget you. It sits there, live, as a dormant account.

Your offboarding checklist should mirror your onboarding one, in reverse, and ideally run on the person’s last working day:

• Disable their accounts — email, systems, any cloud apps. Disabling rather than instantly deleting lets you retain data you may need while cutting off access immediately.
• Revoke shared and third-party access — anything they were added to individually, from the accounts software to the social media logins.
• Rotate shared passwords — any login the departing person knew should be changed at once. This is why individual accounts are so much easier: fewer passwords to scramble to reset.
• Reclaim company data and devices — files, and any company hardware. If they used their own phone or laptop, make sure company data is removed or its access switched off centrally.
• Remove MFA and recovery access — so they can’t reset their way back in through a linked personal phone or email.
• Handle it faster if the exit is difficult. For a planned, friendly departure, the last day is fine. For a dismissal or a resignation that turns tense, treat access removal as a same-hour job, not a next-week one.

The role of individual accounts and central control

Everything above is dramatically easier if two things are true: everyone has their own account, and those accounts can be switched on and off from one place. Shared logins are the enemy here — you can’t remove one person from a password everyone uses without disrupting the whole team.

Centralising your accounts, typically through Microsoft 365 or Google Workspace admin controls, turns offboarding into a two-minute task: disable the user, and their access to everything connected drops away at once. For a growing team, that shift from chasing individual logins to flipping a single switch is one of the highest-value improvements you can make, and it sits naturally within managed IT support.

Make it a habit, not a heroic effort

The firms that get this right aren’t the ones with the biggest IT budgets — they’re the ones who wrote the checklist down and follow it every single time. Onboarding and offboarding shouldn’t rely on one person remembering the steps in their head. A short, shared process means it happens the same way whether you’re welcoming your busiest week’s third new hire or saying goodbye to someone in a hurry.

If you’re not confident that every past leaver has truly lost access — or that new starters are set up securely from day one — that uncertainty is itself the risk. It’s also very fixable. As part of getting your cyber-security foundations in order, we can build you a simple joiners-and-leavers checklist and the central controls to run it cleanly. Get in touch and we’ll make the whole thing routine.