When a staff member or contractor leaves, the focus is usually on handover, final payments, and continuity. Email account offboarding often gets deferred — and in small businesses, it is sometimes never completed. Months or years later, a former staff member may still have active access to business email, shared drives, and client communications. This guide provides a practical checklist for finding and closing that access.
Accounts, aliases, groups, and forwards
The most obvious access to revoke is the person's main email account. Suspend or delete it, depending on whether you need to retain the emails for legal or business continuity reasons. In Google Workspace and Microsoft 365, you can suspend an account (which disables login but retains the email data) before deleting it — giving you time to reassign or archive important correspondence.
Beyond the main account, check whether the person was added to any email aliases (like accounts@ or support@) that continue to receive real business email. Aliases do not have their own login, but they do affect where business email lands. If the person was the primary recipient of an alias, reassign it or redirect it to an active account.
Check group memberships — in Google Workspace, these are Google Groups; in Microsoft 365, Distribution Groups and Microsoft 365 Groups. A former staff member who is still a member of a group will continue to receive any email sent to that group, even after their main account login is suspended, if the group sends to an external email address they have access to. Remove them from all groups as part of offboarding.
Forwarding rules are easy to miss. If the former staff member set up a personal forwarding rule that sends all incoming email to their personal address, that rule may still be active on the server even after the account is suspended. Check the account's mail settings for any active forwarding rules before suspending or deleting it.
Admin roles and recovery options
If the former staff member had admin access to your email platform — the ability to manage users, reset passwords, or change billing settings — remove that access first, before removing the account. An admin account that still has platform admin rights after the person leaves is a significant risk. In a worst-case scenario, a disgruntled former employee or an attacker who acquires their credentials can lock you out of your own email system.
Check account recovery options too. Some email platforms allow a user to set a personal recovery phone number or email address. If the former staff member's personal number or address is listed as a recovery option for a business account, update it to a current, monitored business address before their departure.
How often to review access
For businesses with regular staff turnover or a mix of employees and contractors, a quarterly access review is a realistic cadence. It takes 15–20 minutes to run through the user list in Google Workspace or Microsoft 365 admin consoles, compare against your current staff list, and flag any accounts that need attention. Building this into a regular internal process — even a simple spreadsheet check — reduces the risk of stale access accumulating.
- On departure: suspend the account immediately, then plan deletion or archive within 30 days.
- Check and update all email aliases the person was a primary recipient for.
- Remove the person from all Google Groups or Microsoft 365 Groups.
- Check the account for any forwarding rules before suspending it.
- Remove any admin roles from the account before deactivating it.
- Update account recovery options to remove personal phone numbers or external email addresses.
- Run a full access review quarterly — compare your platform's user list against your current staff list.
Former staff access is a common quiet risk after growth, turnover, or contractor work.
Check email login security