A new employee should be able to work without borrowing someone else’s login. A departing employee should not leave a puzzle of shared files and unexplained access behind. Both outcomes depend on a process connecting HR, line managers and the people administering your systems.
Joining, leaving and changing roles should be one coordinated account lifecycle, not three unrelated tasks.
Use one authorised request
Define who can request a new account, change a role or notify IT that someone is leaving. Gather the start or departure time, manager, role, equipment and access requirements in a consistent format. Include contractors and temporary staff. A request received late may affect delivery, so agree practical lead times and an urgent exception route rather than assuming every change can happen instantly.
Give access for the role
Use the duties of the role to decide which applications and shared information are needed. Avoid treating a previous employee’s access as a perfect template. Review extra permissions separately and record who approved them. Include the device, authentication enrolment and the route for support. A manager should confirm the new starter can perform essential tasks before the onboarding request is considered complete.
Plan departures before deleting anything
Access removal and information preservation are different tasks. Microsoft’s former-employee guidance covers securing access and handling mailbox and OneDrive information. Agree what must be retained, who needs authorised access and which organisation policies apply before accounts or licences are removed. Consider shared accounts, supplier portals and application ownership too. A Microsoft 365 change alone may not cover all the places the person could sign in.
Technical background: Microsoft: Remove a former employee and secure data ↗
Review people who move roles
Internal moves can accumulate access just as easily as new starters can receive too much of it. Include permission review when someone changes department or responsibility. Periodically compare your account list with an approved staff and contractor list. Investigate accounts with unclear owners rather than assuming they are harmless. A straightforward lifecycle process is easier to maintain than a one-off cleanup every time access becomes confusing.
PUT IT INTO PRACTICE
Your starting checklist.
Use these prompts to prepare your next decision or conversation.
YOUR NEXT STEP WITH IT MOUNTAIN
Turn the question into a plan.
Discuss your starter, mover and leaver process with IT Mountain. Connect Microsoft 365 administration, device preparation and approval responsibilities.
