Offboarding employees: how to close email and account access safely
2 min read · Updated October 15, 2026
On the last day, disable sign-in, revoke sessions and app tokens, reset shared passwords, forward or archive mail as policy allows, transfer ownership of files and review the person’s access to third-party tools. Delay deletion until you have what you need.
Why offboarding is a security task
Forgotten accounts keep working. They hold old passwords, may be exposed in breaches and often go unmonitored, which makes them attractive for attackers and a risk if a former employee keeps access.
Checklist for the last day
- ✓Disable the account or block sign-in and revoke active sessions.
- ✓Remove the person from groups, shared mailboxes and distribution lists.
- ✓Reset passwords on any shared accounts they used.
- ✓Revoke tokens and third-party app access.
- ✓Retrieve or wipe company devices.
See how exposed your team’s email is
Leaked work emails fuel phishing and account takeover. Review your company’s exposure with a corporate audit.
Handling the mailbox
Decide whether to forward mail, set an auto-reply or give a manager delegated access. Forwarding should be time-limited and documented. Keep or archive data according to your retention policy before deleting anything.
Review afterwards
Look at sign-in logs for activity after departure and include former employees’ addresses in your next exposure check.
Frequently asked questions
Should we delete the mailbox immediately?+
Usually not. Disable access first and delete after your retention and handover needs are met.
What about shared passwords?+
Reset them whenever someone with access leaves.
Does this apply to contractors?+
Yes. Contractor and freelancer access should end when the engagement does.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.