In most SMEs, onboarding a new employee is documented somehow — on a sheet of paper, in an email to HR, at least in someone's head. Offboarding is almost never documented. And it's offboarding that decides whether a former employee leaves behind clean accounts — or a long shadow inside your systems.
The typical pattern looks like this. The employee hands in notice, works two months as normal, returns the laptop on the last Friday, the manager says "thanks, good luck", and IT (an external service provider, one part-time admin, or the owner's tech-savvy brother-in-law) finds out about the whole thing two weeks later, by accident, while doing something else. The mailbox is still active, the Microsoft 365 licence is still being paid for, the VPN is still accepting connections, and nobody even knows there's an account to remove in some vendor portal — because procurement set it up directly, bypassing IT.
These aren't dramatic cyberattack-news stories. They are everyday, quiet leaks that cost the company real money and real risk.
What an employee actually leaves behind
When someone leaves a 30–50-person firm, they typically touch more than a dozen systems — often more than anyone remembers. Our audits in Polish SMEs show that a typical office employee leaves behind 8 to 15 active credentials. Most often:
- An account in the main directory (Active Directory, Microsoft 365, Google Workspace), with email, calendar, OneDrive or Google Drive.
- An account in ERP/CRM (Comarch Optima, Subiekt, enova365, Microsoft Dynamics AX, in-house apps) — usually with full history of logins and issued documents.
- Accounts in supporting systems — HR, warehouse, invoicing, e-commerce, courier portal, bank portal.
- Access to shared drives, folders and Teams/Slack channels — often with files only this employee ever created.
- VPN, remote access, SSH keys for technical staff.
- Accounts in third-party portals — supplier panels, marketplaces, bank portals, SEO tools, AI tools, subscriptions where the employee is the primary user.
- Mobile work apps installed on a private phone (Outlook, Teams, industry-specific apps).
- Office access card, keys, fobs, hardware tokens — from an IT point of view, all of these are "access".
Each of these has a lifecycle. If you don't end it deliberately, it either ends on its own — or it never ends at all.
A real example: 32-person B2B wholesaler
One of our clients — a 32-person wholesaler in technical accessories — had their sales manager leave. Standard process: two months' notice, contact handover, last Friday, laptop returned. Everyone thought the matter was closed.
Five months later, during a security audit, we checked the state of the accounts. The result:
- Active Microsoft 365 Business Standard licence (PLN 60/month × 5 months = PLN 300 of pure waste on the licence).
- Active account in Comarch Optima with full CRM and invoicing rights (nobody had been checking whether anyone logged in).
- Active VPN access to the company network from home.
- Email forwarding set to a private Gmail address — configured by the employee a week before leaving, in their own M365 user panel. The forwarding had been active for 4 months and had forwarded ~1,800 emails, including all current correspondence with key customers.
- Active accounts in 4 supplier portals, two of which IT had no idea existed because the sales manager had set them up directly during everyday work.
- Office access card still opened the warehouse door.
Direct financial loss in licences was minor — a few hundred zloty. The direct loss in data was potentially serious — hundreds of customer contacts, sales conversation history, margins, terms. The employee had moved to a direct competitor. Whether the correspondence was used or not, we don't know. We turned off the forwarding. But those emails are gone — they live in someone's private archive now.
After this incident we put in place a standard offboarding process — details below. Over the next two years, across 7 departures, all accounts were closed on the day of separation or the next business day. Zero forwarding, zero leakage, zero "forgotten" licences.
IT offboarding checklist
A sensible offboarding checklist in an SME doesn't need to be long. It needs to be complete and executed to the letter, whether the leaver is a salesperson with customer contacts or a warehouse worker. Here's the version we roll out at clients:
Last day of work (or the day after):
- Disable the account in the main directory (Microsoft 365 / Google Workspace / Active Directory) — disable, not delete. Delete after 30 days.
- Reset the password and force sign-out across all sessions (M365: "Sign out all sessions" in the admin panel).
- Check email forwarding rules — whether there is forwarding to an external address, auto-rules or third-party integrations.
- Forward the mailbox to a manager (auto-responder + internal forwarding for 60–90 days) — so customers get an actual reply.
- Collect company devices — laptop, phone, token, access card, keys. Listed in the handover protocol.
- Remotely wipe company apps from the personal phone (in M365, Intune does this — in Google Workspace, Mobile Management). If the employee had Outlook on a personal iPhone, work data is wiped, personal data stays.
- Disable VPN, remote access, SSH keys, accounts in industry systems.
- Office access card — deactivate in the controller, return the keys.
Within 7 days:
- Audit accounts in "non-corporate" systems — supplier portals, marketplaces, SaaS tools. This is the hardest item, because IT often doesn't even know these accounts exist. Ask the manager: "which external systems did this person use?".
- Reassign ownership of critical documents — files in OneDrive/Google Drive, Teams/Slack channels, projects in tools like Asana or Trello.
- Review permissions in ERP/CRM — was this person the sole owner of any record, customer list or recurring report?
Within 30 days:
- Delete the account or convert it to a shared mailbox (M365 lets you release the licence and keep the mailbox as shared — PLN 0 instead of PLN 60/month).
- Review the SaaS bill — any leftover per-user licences in Slack, Notion, ChatGPT Team, Canva, Adobe?
- Close the loop — short confirmation to HR/finance that all access has been closed.
The whole checklist is one or two hours of IT work and fifteen minutes of the manager's time. It requires no expensive software.
Why this falls through the cracks in SMEs
In practice, we see three reasons offboarding gets neglected:
- No HR–IT communication. HR knows first about a departure, but "it's not their job" to tell IT. IT finds out after the fact. Fix: a standard form/email from HR to IT on the day the notice is filed, not the last day of work. One rule in the HR system or one tickbox in the manager's checklist is enough.
- No register of "non-corporate" accounts. In a 30-person firm, employees create accounts in 40–80 SaaS tools IT doesn't know about. Fix: a simple "tool register" spreadsheet, updated once a quarter. Plus a policy: every new SaaS starts with an account on
it@company.com, not on the employee's address. - No process owner. "IT will do it" in an SME often means "nobody will". Fix: one person (office manager, HR, someone in admin) has it in their job to watch the list. They don't execute every step, but they call IT and ask "are all 12 boxes ticked?".
How to make it happen automatically
In an SME you don't need an IAM system for half a million zloty. You need three things:
- Groups in Active Directory / M365 instead of individual permissions. The employee inherits access from the "sales", "finance" or "warehouse" group. Remove them from the group — they lose everything. No hunting through 15 individual checkboxes.
- Single Sign-On (SSO) for SaaS wherever possible. If the employee signs into Slack, Notion or Asana through M365/Google, then disabling the main account automatically cuts them off from the rest. Microsoft 365 Business Premium supports SSO "in the box" — most SMEs don't use it, though they pay for it.
- A short, written procedure. A one-pager in the HR folder: "who we notify, in what order, by when". A procedure on paper is enforced ten times more often than a procedure "in the manager's head".
Where to start
If you're reading this thinking "we don't have any of these points", do the following in order:
- List in four columns: name of every former employee from the last 12 months, leave date, who supervised account closure, status.
- For each person, check today in the M365/Google Workspace admin panel: is the account disabled? Are there any forwarding rules?
- Build a one-page offboarding checklist and hang it in HR.
- On the next departure — run the checklist, time it, fix what didn't work.
- After three offboardings, the process will settle by itself.
Silence around an employee who left a year ago doesn't mean everything is fine. It often means nobody has checked yet. And the cost of checking is 100 times lower than the cost of an incident three months from now — when nobody remembers that account at all.
If you want to put IT offboarding in order in your company but don't know where to start, we help SMEs break this down regularly. The first conversation is free and takes half an hour.
An account nobody closed is not "inactive". It is active — just on the side of someone who no longer trusts you.