A sales executive leaves in October. In December, their account signs in from a home network and downloads the client price list. Nobody disabled the account: HR assumed IT knew, and IT assumed HR would tell them. It’s rarely malicious at first, but an active account belonging to someone who’s gone is a door nobody is watching. The same applies to admin accounts nobody reviews.
The same-day leaver checklist
- Block sign-in and reset the password on the last day.
- Wipe company data from their phone and collect devices.
- Convert the mailbox to a shared mailbox, or forward it to the manager.
- Move their OneDrive files to the team before the account is deleted.
- Change shared passwords they knew: Wi-Fi, vendor portals, admin accounts.
- Remove their licence so you stop paying for it.
The key is one trigger: HR’s leaving date goes straight to IT, every time.
Clean up admin accounts
An admin account is the most valuable thing an attacker can steal. If you’re not sure how many Global Administrators you have in Microsoft 365, it’s worth checking:
- Find: list every admin role in the Microsoft 365 admin centre.
- Reduce: Microsoft recommends fewer than five Global Administrators. Most people only need a narrower role, such as User Administrator or Exchange Administrator.
- Separate: admins use a separate admin account, not their everyday mailbox account.
- Protect: every admin account has MFA. No exceptions, and no shared admin logins.
Then remove admin rights from anyone who has left or changed role.
Make it a quarterly habit
Once a quarter, compare your list of active accounts with HR’s staff list, and review admin roles and guest users. It takes minutes and closes the doors that are easiest to miss.
How Pentacle IT Solutions can help
Pentacle IT Solutions manages joiners, leavers, admin roles and licences as part of Microsoft 365 managed services for businesses in Lucknow and across Uttar Pradesh.
