Joiners, Movers and Leavers: Keeping the Account List True

Published October 23, 2026 · Last reviewed October 23, 2026

The joiner-mover-leaver process keeps access matched to the people who need it: give new starters the minimum they need, remove old access when a role changes, and close every account on the day someone leaves, including the ones outside your main directory. Forgotten accounts and former staff are a common route into a small business.

Three events, one owner

Someone must own the trigger. In most small firms that is the person who handles hiring and departures (an owner, office manager or HR lead), who tells IT the same day. The process only works if the notice comes from the person who knows, not from the person who happens to notice.

Joiners: least access from day one

Create the account from a role template (groups or licences) rather than copying a colleague’s access.
Register MFA on the first day, in person or on a call, and set up the password manager and a passkey where supported.
Issue a managed device, and log what the person has been given.

Movers: remove the old access

When someone changes role, grant the new access and remove the old. Accumulated access is how a receptionist ends up with rights to payroll. Ask the previous manager what to take away and confirm in writing.

Leavers: the checklist

Follow these steps, in this order, for every departure, whether friendly or not. Move the first two steps earlier if the departure is contentious.

Same day, before the conversation if possible: block sign-in for the account and revoke active sessions, so existing logins stop working.
Reset the password and remove the person’s registered MFA methods and trusted devices, so nobody can sign back in with what they set up.
Remove them from systems outside your main directory: the bank and payment portals, payroll, the password manager, accounting package, domain registrar, social media and any shared logins they knew.
Check for forwarding rules, delegated access and connected apps on the mailbox; remove any you did not approve, and give a manager read access or convert the mailbox to a shared one for handover.
Transfer file ownership and shared documents to a manager before anything is deleted, and set an auto-reply that points to the right contact.
Collect and wipe or reassign laptops, phones and tokens, and remove the devices from management records.
Keep the account (disabled) for the retention period you have chosen, then delete it and reclaim the licence. Record the date each step was done.

Make it checkable

Action: Keep one leaver checklist and a record for each departure. Store the checklist in your ticketing system or a shared document, and sign off each step with a date and initials. Add the services outside your directory by name: bank, payroll, registrar, social media, marketing tools.
Why it helps: A leaver process that depends on memory fails on the system nobody thought of, and that is usually the one with money in it.
Verification: Pick the last two departures and confirm every step has a date on it.
Fallback if delayed: If tickets are impractical, a printed form signed by the manager and the IT contact is enough.

Action: Use the provider’s admin tools to disable, revoke and hand over. Profile A In the Microsoft 365 admin center, follow the “remove a former employee” steps: block sign-in, sign out of all sessions, convert or share the mailbox and grant access to the OneDrive files. Profile B In the Google Admin console, suspend the user, reset sign-in cookies, and transfer Drive files before deleting the account; a recently deleted user can be restored for a limited time. Profile C For hybrid directories, disable the account in on-premises Active Directory and wait for the sync, or force it, then confirm in the cloud console.
Why it helps: Disabling is quick and reversible, while deleting too early destroys mail and files the business may need.
Verification: Open the user in the admin console and confirm sign-in is blocked and no active sessions are listed; ask the manager to confirm the mailbox hand-over works.
Fallback if delayed: If you cannot do the handover today, disable the account and set a date to finish it.

Action: Run a quarterly access review. Export the user list from each major system and compare it with the current staff list. Flag accounts with no sign-in for a period you choose (60 or 90 days are common choices), guest users, contractors, and service or shared accounts that have no named owner.
Why it helps: Even with a good process, accounts get missed. The review catches drift and shows you the stale ones attackers love.
Verification: Every account on the export has a current owner or has been removed, and the date of the review is recorded.
Fallback if delayed: Start with the three systems that hold money or customer data and extend later.

Common failure mode

Disabling the directory account and thinking the job is done. Many services keep their own logins: the bank portal, the payment processor, the domain registrar, marketing tools, supplier portals and the shared passwords the person knew. The second common error is deleting the account at once, which removes the mailbox and files and the licence trail that you may later need for a dispute or an audit.

How it works

Access follows a lifecycle: it is granted, changed and removed. Most incidents attributed to “former employees” are ordinary access that was never removed. The process closes three gaps: timing (same-day removal), coverage (systems outside the directory, shared secrets, devices) and evidence (a dated record per step).

Control catalogues such as NIST SP 800-53 treat termination and transfer of personnel as controls in their own right, which reflects how often this is the weak link. The quarterly review is the second line of defence: it checks the result rather than trusting the process.

Worked example

This is a hypothetical example with invented figures. A 15-person marketing agency lets a contractor go on a Friday afternoon. The office manager emails the IT contact at once. By 4 pm the account is blocked and its sessions revoked, the password changed and the mailbox shared with the account manager.

The checklist also prompts the office manager to remove the contractor from the ad platform, the social media tool and the shared stock-photo login. Two weeks later, the quarterly review finds an old freelancer account that nobody had closed. It is disabled the same afternoon, and the checklist gets a new line for freelancers.

Frequently asked questions

How fast must a leaver's access be removed?

On the day they leave, and before the conversation if the departure is contentious. Block sign-in and revoke sessions first, then work through the rest of the checklist.

Should we delete a former employee's account?

Not immediately. Disable it, hand over mail and files, and keep it for your retention period before deleting it, so that you can still find records and reclaim the licence cleanly.

What about contractors and shared accounts?

Treat contractors like staff with an end date set in advance, and give shared accounts a named owner. Review both every quarter; they are the accounts most often forgotten.

Do small businesses really need a formal process?

Yes, but it can be one page. The value is in the same-day trigger, the list of outside systems and the dated record.

Want checks like this in your inbox?

The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.