Most small businesses in Musselburgh have a hiring process — a signed contract, a probation chat, an induction morning. Very few have anything like a proper leaving process on the IT side. When a staff member hands in their notice, the focus is on the handover of work, not on the quiet trail of logins, licences and files they're about to leave behind. This is a practical off-boarding guide written from the workshop bench for small businesses across Musselburgh, Fisherrow, Wallyford and the wider East Lothian — the things that go wrong when nobody thinks about the IT side until after the leaving card has been signed.
If you'd rather have someone else handle the whole leaver process — access revocation, laptop wipe, licence tidy-up — that's exactly what our business IT support team does for small teams across the Lothians.
What Off-boarding Really Means for a Small Business
IT off-boarding is the mirror image of onboarding. When a new hire starts, someone (usually the owner) creates a Microsoft 365 or Google Workspace account, adds them to a couple of shared drives, sets up their email signature, and hands over a laptop. When they leave, all of that has to be systematically undone — plus a layer of shared passwords, third-party SaaS logins and personal-device logins that nobody wrote down in the first place.
Skip it, and the failure modes are usually one of two things. Either the leaver keeps quietly accessing things they shouldn't for months (usually accidentally — a phone that never logged out), or the business ends up paying for licences and services in their name until someone finally notices the bill.
1. Plan Before The Last Day
Off-boarding is much easier if you start it a week before the person actually leaves, not on their final afternoon. What that looks like in practice: a short conversation to list every system they use day-to-day (not just the obvious ones), which shared inboxes and mailboxes they have access to, which customer accounts they own, and which subscriptions or SaaS tools are in their name rather than the business's.
Almost every off-boarding we help with turns up something the owner didn't know about — a domain registrar login, a Companies House filing account, a Xero connection, an old MailChimp workspace. Once you've made the list, the actual day-of-departure steps are quick. Skip the list, and you'll be discovering these one at a time over the next six months.
2. Revoke Access — In The Right Order
The temptation is to disable everything the moment someone walks out the door. That's usually fine, but the order matters if you also need the leaver's inbox, files and calendar afterwards.
On the last day, disable password login (don't delete the account yet), then sign the user out of all active sessions — Microsoft 365 has a one-click "sign out of all sessions" that immediately kicks the account off phones, tablets and browsers. Then rotate any account they had admin access to, in this rough order: banking and payment gateways first (Stripe, GoCardless, PayPal), then Microsoft 365 or Google Workspace admin, then domain registrar and DNS, then the CRM, then everything else. Only after you've confirmed you have the files and email you need do you actually convert the mailbox to a shared mailbox or archive and delete the account.
3. The Shared Passwords Everyone Forgets
This is the trap. Almost every small business we look after in East Lothian has a small pile of shared logins that everyone uses — the office Wi-Fi guest password, the printer admin panel, the alarm system portal, the Xero shared login from three years ago, the Facebook page manager, the Companies House authentication code, the domain registrar. Because everyone uses them, nobody thinks of them as "the leaver's credentials". They are.
The reflex fix: any shared password the leaver knew, change it. That's less painful than it sounds if you're already using a small business password manager — you rotate a few entries and share the new ones. If you're not, a leaver event is the moment it becomes worth setting one up. We covered the wider principle in our post on two-factor login for small businesses; the same discipline applies to shared credentials in general.
4. Redirecting Email And Handing Over Files
Two options for the leaver's email. If they had public-facing responsibilities — sales enquiries, customer support, supplier contacts — convert their mailbox to a shared mailbox (in Microsoft 365, "convert to shared" is a menu option; in Google Workspace, delegate the mailbox to another user first). Anyone in the business can then pick up replies from what used to be their address, and inbound customer emails don't bounce for the next three months.
For files, the danger area is anything the leaver saved to their personal OneDrive or Google Drive rather than a shared team drive. A Musselburgh accountant rang us last winter on a Friday afternoon — their bookkeeper had left on the Wednesday, and by Monday they realised the current payroll spreadsheet lived in the leaver's personal OneDrive that had already been suspended. Recoverable, but only inside the retention window and only if someone opens a ticket in time. Before the last day, ask the leaver to move anything work-related out of personal storage into a shared team drive, and then have someone verify it's actually there.
5. Wiping And Reissuing The Laptop
The physical device is the part small businesses tend to handle well and the account side is the part they don't — but there's still a common mistake. "Format and reset" from the Windows recovery menu leaves a lot behind if the drive was ever encrypted with anything other than BitLocker, and it certainly doesn't undo whatever the leaver had signed into.
What we do on the bench: sign the machine out of every Microsoft, Google, browser-sync and password-manager account first (browsers hold live sessions long after a Windows reset), then a full Windows reinstall using "remove everything" with the "clean data" option on. For a device with sensitive customer data on it, we'll do a proper secure wipe rather than a reset — SSDs need a specific erase command to actually clear the cells, not just the file table. If the machine's going to a new hire, we set it up fresh with the new user's account rather than renaming the old one. Our Musselburgh laptop repair workshop handles this end-to-end, along with any hardware refresh the machine needs before it goes out again — replacing a tired battery, a scratched palm rest, or a cracked screen the leaver didn't mention.
If the device is being retired rather than reissued, don't put it in the cupboard "for now". A cupboard full of decommissioned laptops is a cupboard full of business data. We handle secure decommissioning and certified destruction through our IT recycling service, which gives you a written record of what happened to each drive.
6. Cancelling The Licences You'll Otherwise Keep Paying For
The single most common oversight, and the one that quietly adds up over months: SaaS licences left running in the leaver's name. Microsoft 365 seats, Adobe Creative Cloud, Xero user seats, Slack, Canva Pro, Zoom, Trello, Notion, an antivirus subscription, the CRM. If IT was told to "disable, not delete" the account and never came back for the delete step, most of those keep billing.
The tell-tale is a monthly card statement that hasn't got any smaller since the person left. The fix is boring and manual: go through the last twelve months of card transactions, mark the SaaS ones, and check each vendor's admin panel that the seat is actually gone. One insurance broker we work with in East Lothian found six months of Microsoft 365 licence charges still going out on a leaver they thought had been fully off-boarded. Not the end of the world — but avoidable.
The Simple Off-boarding Checklist
The bones of what we run through with a small business the day someone leaves:
- List every system the leaver had access to — do this a week ahead if possible.
- Sign the account out of all active sessions before disabling login.
- Rotate every shared password the leaver knew, starting with anything money-related.
- Convert their mailbox to shared or delegate it so incoming emails don't bounce.
- Move work files out of personal cloud storage into the shared drive, verified.
- Revoke MFA devices — remove their phone from the authenticator app for anything critical.
- Reset or securely wipe the laptop, then decommission or reissue.
- Cancel or reassign every paid licence in their name — checked on each vendor's portal, not just billing.
- Change the office Wi-Fi and any door-code they knew if they were on-site.
- Diarise a 30-day and 90-day check to catch anything you missed the first time.
None of this is complicated. It's just tedious, and it's the kind of tedium that gets postponed and then forgotten.
Getting An Off-boarding Process That Works
Off-boarding is the same story as onboarding a new employee, run in reverse. Small businesses that already have a written onboarding checklist tend to find off-boarding straightforward — same list, backwards. If you don't have either, you're not alone; most of the small businesses we look after around Musselburgh, Prestonpans and Tranent were in the same position before we sat down with them. The same trajectory shows up in our post on outgrowing DIY IT: the point where informal processes stop working is usually the point where a formal one saves real money.
If you'd like a hand building a leaver process that actually gets followed — or you've got a departure coming up and want the whole thing handled properly — our business IT support team covers small businesses across Musselburgh and the wider Lothians, and our remote support tooling means most of the account-side work can be done without a site visit. On-site collection of the laptop is a callout we do most days of the week already, so it's rarely a hassle to fit in. Book a consultation online and we'll walk through what a proper off-boarding looks like for the way your business actually works.
Last updated: 1 August 2026