Starters tend to get careful attention — a new account, the right access, a proper introduction to the systems they'll use. Leavers often get much less, and that gap is where real problems tend to start.
Why a Leftover Account Is a Security Risk
An account that isn't properly disabled when someone leaves is a live door into your business — still able to receive email, still holding access to files, still potentially usable if the login details are ever compromised. It's one of the more common, entirely avoidable gaps in small business security.
What Should Happen, Step by Step
A proper leaver process for Microsoft 365 typically covers:
- Disabling sign-in immediately, so the account can't be used to log in
- Converting the mailbox to a shared mailbox if ongoing email access is needed by colleagues
- Setting up an auto-reply or forwarding rule where appropriate
- Reassigning or removing the Microsoft 365 licence
- Transferring ownership of any files or Teams the person managed
- Deciding on a retention period before the account is fully deleted
Why Timing Matters
Ideally, account access is disabled at the exact moment employment ends — not "sometime that week" once someone remembers. For anything sensitive, the gap between someone leaving and their access being removed is exactly the window where problems happen, whether through simple oversight or something more deliberate.
A Practical Middle Ground
Deleting an account the moment someone leaves isn't always right either — there's often a genuine need to access historical emails or files for a period afterwards. Converting the mailbox to a shared mailbox (rather than leaving the original licensed account active) is usually the sensible middle ground: the content stays accessible to those who need it, without a live, loggable-into account sitting there indefinitely.
What This Looks Like at REONEX
Starter and leaver processing is built into REONEX's managed IT support and Microsoft 365 & Cloud management as standard, not something that has to be separately requested each time. See Managed IT Support Leeds for more on how this fits into the wider contract.