What to get from them while they are still here, what to switch off on the day, and how not to end up here again.
Resources / Our IT person is leaving. What do we need from them before they go?
Before their last day, get four things into the business's own hands: an administrator login to Microsoft 365 that is not theirs, control of your domain, every shared password, and a written note of where the backups are and how to restore one. On the day they go, reset their password and sign them out of everything. It is a calm, two-week job if you start now, and a scramble if you start after they have gone.
Emergency admin logins Microsoft says every business should hold
Until a password reset signs them out of Microsoft 365
To restore a deleted Microsoft 365 account and its mail
In a lot of small businesses, IT is one person. Sometimes it is an employee, sometimes the office manager who is good with computers, sometimes a friend of the owner who set everything up years ago. Whoever it is, they usually hold the only administrator login, know the router password, registered the domain in their own name and are the only one who knows where the backups go.
None of that is a problem while they are there. It becomes one the day they leave, because the business suddenly depends on a former employee answering the phone. Most people leave on good terms and are happy to help, but goodwill fades, phone numbers change, and the question always comes up at the worst possible moment.
So treat the notice period as the handover window. Everything below is easy to do while they are still around and hard to do once they are not.
An administrator login that belongs to the business. Microsoft recommends two or more emergency access accounts with the Global Administrator role, set up so they are not tied to any one person, and names the exact situation this post is about: the person with the most recent Global Administrator access leaves.3 Ask your IT person to create them now, and keep the details somewhere the owners control.
Your domain. Your website and email both depend on it. Check who the registrant is and which email address is on the record. For a .au domain the transfer code goes to the registrant contact email,5 so if that is their personal address, change it before they go. Our free Domain Checker shows who the registrar is and when the domain expires.
Every shared password. The router, the firewall, the wifi, the alarm, the accounting software, the supplier portals, the social media pages. Ask for them to be moved into a password manager the business owns, not sent in an email or a spreadsheet.
A written note on backups. What is backed up, where it goes, who pays for it, how far back it reaches and how a restore is done. Ask them to show someone else a test restore before they leave. A backup nobody else can restore is only half a backup.
Beyond the four essentials, ask for a short written summary of the setup. A list of computers and phones and who has each one. Every software subscription, with the account it is billed to and the renewal date. Supplier and vendor contacts, including the internet provider and whoever supports the phone system. Any scripts, scheduled jobs or odd fixes that only they know about.
Watch for things that are quietly in their name: a credit card paying for a cloud service, an Apple or Google account that manages the company phones, a personal mobile number set up as the recovery number on a business account. Each of those needs moving to the business before the card is cancelled or the number is gone.
It does not need to be polished. A page of plain notes your next IT person can read is worth more than a perfect document that never gets written.
Microsoft's own steps for a departing employee start with resetting their password, then using Sign out of all sessions in the admin centre. They are prompted to sign in again within an hour. Blocking sign-in on its own can take up to 24 hours to take effect, so reset the password first.2
Then decide what happens to their mailbox and files before you delete anything. Their email can be forwarded or turned into a shared mailbox so customers who write to them still reach someone, and a colleague can be given access to their OneDrive. Once an account is deleted, its OneDrive and Outlook content is kept for 30 days and can be restored in that time.1 After that it is gone, so move what you need first.
Last, change every shared password they knew. The Australian Signals Directorate makes the point plainly: unless you change the password, people can keep accessing shared accounts after they have left the business.4 Wipe or collect any company devices, and remove their phone from the business's email.
The underlying problem is that the business's IT lived in one person's head. Fix that whoever runs IT next. The domain and every administrator account in the business's name. Shared passwords in a password manager the owners can open. Backups someone else has seen restored. A one-page summary of the setup, updated once a year.
If you are hiring a replacement, put those expectations in the role from day one. If you are moving to an outside provider instead, the same list applies, and our guide to changing IT providers covers the extra steps for licences and partner access.
Either way, the test is simple: if the person who looks after your IT disappeared tomorrow, could the business get into its own systems by lunchtime? If the answer is no, that is the job to do this month.
How do I change IT providers without breaking everything?: If an outside provider is taking over: licences, partner access and the handover order.
Free Domain Checker: See who holds your domain and when it expires.
Does Microsoft back up my emails and files?: What Microsoft keeps, for how long, and what it does not.
An administrator login to Microsoft 365 that belongs to the business, control of your domain, every shared password moved into a password manager the business owns, and a written note of where the backups are and how to restore one.
Reset their password, then select Sign out of all sessions in the Microsoft 365 admin centre. They are prompted to sign in again within an hour. Blocking sign-in alone can take up to 24 hours, so reset the password first.
Ask them to create two emergency administrator accounts that belong to the business before they go. If they have already left and cannot be reached, getting back in means working through Microsoft support to prove the business owns the account, which is far harder than asking now.
Not before you have kept what you need. Forward their email or convert it to a shared mailbox, give a colleague access to their OneDrive, then delete. A deleted account can be restored for 30 days.
Yes. The Australian Signals Directorate notes that unless you change the password, people can keep accessing shared accounts after they leave. Change every one they knew, starting with the router, the accounting software and the bank.
Tell us who runs your IT now and when they finish. We will give you the exact list to get from them before they go, and check you hold your own admin access. Free 30-minute call, no obligation.
Prefer to talk? Call (02) 9053 8789.
Belivanis Information Systems