Turn off access on the last day

When someone leaves a small business, the goodbye usually goes fine. There is a last day, maybe lunch, and the laptop goes back in a drawer. What often does not happen is the boring part: turning off every login that person had. Weeks later they can still get into the scheduling tool, the shared inbox, the payment dashboard, and the phone system's admin page. Nobody meant for that to happen. Nobody had a list.

When we build or run software for a client, we treat offboarding as a feature of the system, the same as signing someone up. This post covers how we set it up so access ends on the last day, not whenever somebody remembers.

Why access outlives the job

Most of the time there is no bad actor in this story. Access hangs around for ordinary reasons.

Nobody knows the full list. A growing team picks up tools one at a time. The office manager signed up for the invoicing app. A tech added himself to the parts supplier portal. The owner shared the password to the social account in a text. No single person can name every place a given employee has a login.

Shared logins hide who is inside. When three people use the same username for the booking tool, you cannot remove one of them. You have to change the password and tell the other two, which feels like a hassle, so it gets put off.

Personal accounts get mixed in. Someone connects their own email to a business calendar, or sets up the company's ad account under their personal login. When they leave, the business discovers it does not fully own its own tools.

Phones and keys are physical. A work phone with the company apps still signed in, a key fob, a tablet in a service van. These get returned late or not at all, and each one may still be logged in.

API keys and connections outlive people. If an employee built a quick automation that connects two tools, it may be running under their account with a key only they created. Turn off their account and the automation breaks. Leave it on and they still have a working key.

None of this shows up as an error. Everything keeps working, which is exactly the problem.

Build the access list before you need it

The fix starts long before anyone leaves. We keep one plain list of every system the business uses and who has access to each one. It does not need special software. A shared spreadsheet the owner controls is fine to start.

For each tool, the list answers a few questions:

• What the tool is and what it holds, such as customer records, payments, call recordings, or schedules.
• Who owns the account, meaning which business email it is registered under.
• Who has a login, by name, and what level of access each person has.
• Whether any shared logins exist, and who knows them.
• Whether anything automated runs under a person's account.

The first pass always turns up surprises. Old accounts for people who left a year ago. A vendor who still has admin rights. A tool nobody uses anymore that still holds customer phone numbers. Clean those up while you are there.

Then keep the list current. When someone joins, their row gets filled in as their logins are created. When a new tool comes in, it gets added before anyone starts using it for real work. That habit is what makes offboarding fast later.

Give everyone their own login

Shared logins are the single biggest reason access lingers, so we push hard to get rid of them. Each person gets their own account in each tool, tied to a business email address the company controls.

That makes removal one step for one person. It also means the logs show who did what. If a booking gets deleted or a refund goes out, you can see which person did it instead of guessing among everyone who knew the password.

Where a tool truly only allows one login, we store that password in a password manager the business owns and share it through that, never in a text or a sticky note. When someone leaves, the password gets changed and the manager pushes the new one to the people who still need it. Nobody has to retype anything from a group chat.

Where it is available, we also turn on single sign-on, where people log into many tools through one business account. Then turning off that one account closes most doors at once. It does not cover every tool a small business uses, so the access list still matters, but it shrinks the job a lot.

Run offboarding as a checklist, on the last day

With the list in place, offboarding becomes a short checklist that one named person runs on the person's last day. Not the week after. The same day.

Here is the shape we use:

• Turn off the main business account first. Email and single sign-on, if you have it. This cuts off password resets that would let someone back into other tools.
• Go down the access list row by row. Remove or disable the person in each tool and mark it done with the date.
• Change any shared passwords they knew. Update them in the password manager.
• Move ownership of anything in their name. Calendars, documents, automations, and accounts registered under their login get handed to a business owner account before the old one is closed.
• Check the phone system. Remove them from call routing, forwarding rules, and voicemail. A forwarding rule that still sends after-hours calls to a former employee's cell is a real way to lose customers.
• Collect devices and sign them out. Work phones, tablets, and laptops get wiped or signed out of every business app.
• Rotate any keys they created. If they built an automation, replace its key with one owned by the business and confirm the automation still runs.

When we build custom software for a client, we add an offboarding switch to the admin side. One action disables the person's login, ends their active sessions, removes them from any assignment queues, and records who did it and when. That turns most of the custom system into a single step instead of a hunt.

Watch for the ones you missed

Even a good checklist misses things, so we add a quiet check a week or two later.

Look at recent sign-in activity in the main tools for the departed person's name or email. Most business tools show a list of active users or recent logins. If their name shows up anywhere, fix it and add that tool to the list so the next offboarding catches it.

Also look for anything that broke. If an automation stopped running or a report went missing, it was probably tied to their account. That is a sign to move more things onto business owned accounts before the next person leaves.

Start with the list this week

You do not need to fix everything at once. Start by writing down every tool the business uses and who can log into each one. Remove anyone who no longer works there. Then pick one shared login and split it into individual accounts.

The next time someone leaves, you will have a checklist instead of a guess, and the last day will be the last day they have access, which is how it should have worked all along.