A staff member left. Do they still have our logins? How to remove access properly
⏱ In about 8 minutes
Affiliate disclosure: Some links on this page may become affiliate links. If you buy, we may earn a commission at no extra cost to you. Commissions may influence which products we choose to cover, but not our assessment of them. Read the full disclosure.
In this article
The short answer
Short answer
If you can't say for certain, assume they still do. Remove their access on their last day: disable their own accounts, take them out of shared vaults, change any shared passwords they knew, and get company devices and data back.
The ACSC is clear: "Remove access promptly when staff leave" and "change login details when staff leave or change roles." (ACSC) A business password manager such as 1Password or NordPass makes this a few clicks instead of an afternoon of guesswork.
Why this matters, even when people leave on good terms
Most departures are friendly. The risk usually isn't revenge; it's loose ends:
- Old accounts become easy targets. An inbox nobody watches won't notice a password-reset email or a login from overseas.
- Shared passwords travel. If a leaver knew the login for your bank portal or social accounts, so might anyone who later gets into their personal devices or accounts.
- You can't prove who did what. The ACSC notes shared accounts "increase security risks and make it harder to track activity." (ACSC)
- Suppliers have access too. The ACSC says businesses should understand what external providers can access, and that access "should be reviewed regularly and removed when it is no longer required." (ACSC)
The cost of doing nothing is a door left open with your name on it. The cost of doing it properly is about an hour per leaver, less once you have a list.
Fix it: the offboarding checklist
The time guides are rough, for a small business. Do the first three steps on the person's last day, ideally at the end of it.
Step 1: Disable their personal work accounts (15 minutes)
- Email: suspend or disable the account rather than deleting it straight away, so you keep their messages. Set up forwarding or an auto-reply to a colleague.
- Every other system with their own login: accounting software, CRM, project tools, cloud storage, website admin.
- Sign them out everywhere. Many services have a "sign out of all sessions" option. The UK NCSC recommends logging "all devices and apps out" after changing passwords on a compromised account, and the same step makes sense here. (NCSC)
Step 2: Remove them from the password manager and shared vaults (5 minutes)
With a business password manager, this is one action: suspend or remove the user. They lose access to every shared vault at once.
Step 3: Change the shared passwords they knew (20–40 minutes)
Removing someone from the vault doesn't erase their memory or anything they copied. Change the passwords for shared logins they could see, starting with banking, email admin, domain and social media. The ACSC's guidance is to "Update or change key logins when you have staff turnover." (ACSC, Restrict and monitor access)
Tip: password health reports in a business password manager help you see which shared items to update.
Step 4: Remove 2FA devices and recovery details (10 minutes)
Check whether their phone number or personal email is set as a recovery option or 2FA method on any business account (domain registrar, social media and ad accounts are common). Replace it with a business-controlled one.
Step 5: Get devices back and wipe them (30 minutes)
Collect laptops, phones, keys and security tokens. Before reissuing or disposing of a device, the ACSC says to "remove all information from your business devices before selling, trading or throwing them away", for example "by doing a factory reset." (ACSC)
Step 6: Transfer ownership of files and accounts (20 minutes)
Make sure documents, shared drives, social pages and any accounts registered in their name are moved to a business owner or a role-based account.
Step 7: Review in 30 days, then close the mailbox (10 minutes)
Check nothing important still goes to their address. Then remove the account. The ACSC advises businesses to "delete email accounts you no longer use or monitor." (ACSC)
Copy-and-use offboarding template
LEAVER: ____________ LAST DAY: ________ CHECKED BY: ____________
[ ] Email account suspended; forwarding/auto-reply set
[ ] Signed out of all sessions (email, cloud, CRM, accounting)
[ ] Removed from password manager / shared vaults
[ ] Shared passwords they knew changed (list): ______________________
[ ] Their phone/email removed as 2FA or recovery on business accounts
[ ] Laptop / phone / keys / security key returned
[ ] Devices wiped before reuse or disposal
[ ] Files, drives and accounts transferred to: ____________
[ ] Supplier/contractor portals checked
[ ] 30-day review done; mailbox closed on: ________
Quick pick
Quick pick: password managers that make offboarding fast (product details from official vendor pages, checked 18 Oct 2026. Not hands-on tested. No ratings. Confirm prices and features on the vendor's site.)
- Best for most small teams: 1Password. Role-based vault permissions, custom groups, and reports on weak, reused or breached passwords to help you see what to rotate. Teams Starter Pack listed at US$24.95/month billed annually for 10 members. 14-day free trial. → See our password manager guide
- If you want group- and folder-based sharing: NordPass. The Business plan lists group-based and folder-based credential sharing and user activity monitoring, from US$3.59 per user/month on the 2-year plan (5-user minimum). Free trial available. → See our password manager guide
Budget option and full comparison: Which password manager should my small team use?
Honest limits
Free: the Small Business Password & Access Checklist
A 1–2 page checklist that turns this article into a to-do list: which accounts to protect first, how to set up shared access, and what to do when someone joins or leaves.
You only get emails if you tick the consent box. Unsubscribe any time. See our privacy policy.
Frequently asked questions
Should we delete their email account straight away?
Usually not. Suspend it, forward or auto-reply, and close it after you've checked nothing important is still arriving.
Do we really need to change shared passwords if they left on good terms?
Yes. It's not about trust. Their personal devices or accounts could be compromised later, and you'd never know your passwords went with them.
What about contractors and agencies?
Treat them the same. When a project ends, remove their access. The ACSC says third-party access should be "removed when it is no longer required."
How do we stop this being a scramble every time?
Keep a simple list of every system each role uses. Use it to set people up (see our onboarding checklist) and run it in reverse when they leave.
Related guides
- Cybersecurity tools · Password managers
- My staff reuse passwords: how to fix it this week
- Which password manager should my small team use?
- New staff take weeks to get set up: onboarding checklist
Sources
Government bodies first. All links checked and loading on 18 Oct 2026.
- Australian Cyber Security Centre: Securing accounts and identities · Restrict and monitor access · Protecting devices, systems and networks · Common cyber threats to small businesses
- UK National Cyber Security Centre: Recovering a hacked account
- Vendor pages (checked 18 Oct 2026): 1Password business pricing · NordPass pricing · NordPass business plans
About our review process
We pick products from official information and say clearly when we haven't tested something hands-on. Commissions may influence which products we choose to cover, but not our assessment of them. See how we work.