Someone starts on Monday and can't log in until Wednesday. Or someone left months ago and still has access to your CRM. Both come from the same gap: nobody wrote down what a person needs, so it gets rebuilt from memory each time.
Here's a checklist for both ends.
Start with the account everything hangs on
The account that holds your email and files is your Microsoft 365 or Google Workspace tenant. Most of your other apps sign in through it, so it's the first thing to set up for a new hire and the first thing to lock when someone leaves.
When someone joins
| Step | What to do |
|---|---|
| Account | Create their account in your Microsoft 365 or Google Workspace tenant, with the groups and shared mailboxes their role needs |
| Sign-in security | Turn on multi-factor sign-in before they log in for the first time |
| Supporting apps | Give access to the tools their job uses, such as your CRM and task management |
| Platform access | If your company offers a platform or portal to customers, set their role and permissions |
| Write it down | Record what you gave them, so leaving is easy later |
In practice, the new hire usually gets a welcome email at their personal address that walks them through setting up their work account, including multi-factor sign-in. How strict that is varies: some companies want an authenticator app and strict rules, and others want light requirements and just a password. I advise multi-factor every time, even when a company wants it lighter.
Setting this up before they start means nobody loses their first days waiting on access.
When someone leaves
The order matters here. Do these in sequence, ideally the same day:
- Block sign-in and reset their password. Do this first, so the account can't be used while you sort out the rest.
- Move their mail and files. Companies handle this differently. Common choices are to forward their mail to a colleague who handles those customers, to open the mailbox to a few people, or both. Their drive files can be exported and shared with a manager or whoever takes over.
- Remove access to supporting apps and platforms. This is the step most often forgotten, because those apps sit outside the main account.
- Keep the account suspended for a while before deleting it. If something turns out to be needed, it's still there.
- Collect the device.
Keep one list per role
A short list of what each role needs (the groups, the apps, the platform permissions) turns both processes into a checklist instead of a memory test. Check it once or twice a year, and check who has access to your CRM and other apps as well. Old accounts tend to linger there.
Where I fit
Getting this right is part of the security and access work I do as an IT consultant for small businesses: setting up Microsoft 365 and Workspace accounts, multi-factor sign-in, and clean offboarding. If you're deciding between the two platforms, do you need a Microsoft 365 or Google Workspace consultant is a good place to start, and what a small business IT consultant does explains how a job like this goes.
If you'd like a second look at who has access to what, get in touch for a free consultation and I'll tell you honestly what I'd tighten.