TL;DR: A clean employee offboarding takes about 90 minutes. A messy one can take three weeks. The difference is decided at onboarding, not on the way out. Shared logins, personal devices, and solo SaaS sign-ups made in a new hire’s first weeks turn into a scavenger hunt when they leave. Fix onboarding, and offboarding becomes a checklist.
By the time an employee hands in their notice, the decisions that make their exit clean or messy have already been made. They were made in the first few weeks on the job, when nobody was watching closely because the new hire had just arrived and a hundred other things needed doing. A shared login here, a quick software sign-up there, a personal laptop used until the company one showed up.
By month six, none of that feels like a decision anymore. It just feels like how things work. Then the resignation lands, and every shortcut from those early weeks turns into a problem you now have two weeks to solve.
This is one of the most overlooked parts of running a small business, and it is squarely an IT hygiene issue. A OneLogin survey of 500 IT decision-makers found that at half of organizations, former employees’ accounts stay active more than a day after they leave. This post covers what really goes wrong when offboarding drags on, the four onboarding shortcuts that guarantee a painful exit, how to clean up the team you already have, and what your IT provider should be doing at onboarding that probably is not happening.
Why does a messy offboarding take three weeks?
Offboarding drags on when the groundwork was never laid at onboarding. A clean exit takes about 90 minutes: disable one central account, wipe or collect the device, forward the email, and reassign the person’s files and client records. A messy exit means hunting down logins nobody documented, chasing a laptop still sitting at someone’s house, and finding surprise charges months later.
The clean version works because everything traces back to one identity. Disabling that account in your identity provider, the central system that controls who can log in to what, cascades across every connected tool at once. The messy version starts with a handwritten list of tools nobody fully remembers, which usually means asking the departing employee to help rebuild it. You turn up a design account, a video tool, a database, and a notes app, each set up on its own, each with passwords living in that person’s private password manager.
Identity teams call this the “joiner, mover, leaver” lifecycle, and Microsoft frames it the same way through its Entra lifecycle workflows. A rushed joiner phase does not stay in the past. It reappears as weeks of cleanup the moment someone resigns. Getting this right is a core part of everyday managed IT services, not a special project.
Four onboarding shortcuts that guarantee a messy exit
Four habits from a new hire’s first weeks cause most of the pain later. Letting people sign up for their own software, tolerating personal devices, sharing logins to save money, and letting client relationships live in one inbox each create a gap that only shows up when the person leaves.
Letting new hires sign up for software on their own. When someone signs up for a tool with their work email and a password only they know, that account is effectively theirs. You cannot reset it without alerting them, and you may not even know it exists until an invoice appears or a client project breaks after they leave. The fix is to route every new tool through a central sign-on system before anyone logs in.
Tolerating personal devices “just until we sort it out.” Temporary never stays temporary. The person installs apps, connects to client systems, and downloads files, and the stopgap becomes how they work. When they leave, you cannot wipe company data from a device you do not own and never enrolled in a management system. You are relying on goodwill, which is usually fine but is not a security control.
Sharing logins to dodge per-seat pricing. Shared credentials are the worst offender at offboarding. When five people use one login, you cannot remove one person without changing the password for everyone. You usually learn this at the worst moment, when the person leaving is the one who set up the account and nobody else knows the password. Per-seat pricing is the honest cost of doing this right.
Letting client relationships live in one person’s inbox. When a senior account manager leaves, their client relationships often walk out with them. The history, the preferences, and the half-finished email threads all lived in one mailbox. The fix is a shared inbox or CRM where client messages are logged, so the relationship belongs to the business. Even a shared Microsoft 365 mailbox with a rule that client threads get copied to it beats what most small businesses have today.
How do you fix the team you already have?
Start by auditing what already exists, before the next hire arrives. You cannot re-onboard your current staff, but you can map the gaps and close them before the next departure. Three quick reviews cover most of the risk, and none of them are technical.
First, run a software audit. Pull three months of statements from every card used for business expenses and list every recurring charge. For each one, find out who set it up, who holds the login, whether it uses a personal or company email, and whether anyone else could get in if that person left tomorrow. You will find tools nobody remembers buying and accounts whose owner already left while you keep paying for the seat.
Second, build a device register. Make a simple list of who has what, when it was issued, whether it is enrolled in a management system, and what company data it can reach. Ask every staff member to confirm the devices they use for work, including personal ones. Most people are happy to confirm once they know nothing punitive will come of it. For any personal device with company access, the minimum is routing company email and files through managed apps that can be disconnected remotely. Microsoft’s Intune app protection policies can wipe just the company data from a personal phone without touching anything else.
Third, move client communication into shared places. Set up a shared inbox or alias for client-facing messages, and log contact history in a CRM. The goal is continuity, so the relationship stays with the business when a person moves on. This is also where good cybersecurity protection and clean operations overlap, since scattered access is both a security risk and a business risk.
What should your IT provider do at onboarding?
Your IT provider should be setting up each new hire, not just switching off the account when they leave. Most providers only get the call when someone resigns. They show up, disable what they can find, and work with whatever documentation exists. That is the wrong end of the process to be involved in.
The model that works puts your provider at the start. They create the new account in your identity provider, enroll the device in a management system, and connect every tool through central sign-on so it can all be switched off in one action. They should also keep a short handover document for each person, updated over time, listing the systems they use, the clients they own, and the credentials tied to their identity.
When that is in place, offboarding becomes a one-hour checklist instead of a three-week dig. Ask your provider what they do at onboarding. If the answer is “not much” or “we usually just get called when someone leaves,” that is worth a real conversation about what you are getting from the relationship. This is one of the clearest places where a strong IT partner earns their keep, and it is a natural fit for a co-managed IT setup if you have some internal help already.
A 60-day plan before your next round of departures
You do not need to know when the next resignation will land to get ahead of it. The work is far easier when nothing is on fire. Spread it across eight weeks and it stays manageable.
In weeks one and two, run the card statement software audit and flag every login only one person controls. In weeks three and four, build the device register and set up managed app access for any personal device with company data. In weeks five and six, audit client communication and move the highest-risk relationships into shared mailboxes or a CRM first. In weeks seven and eight, write the onboarding process you wish you had used, then apply it to your next hire from day one and use it as the template for a handover document on every current employee.
Most of this is operational rather than technical. A spreadsheet, a few honest conversations with your team, and a few hours of your IT provider’s time will cover the bulk of it. The payoff is that your next departure costs you an hour instead of three weeks.
Fix the front door and the back door takes care of itself
Messy offboarding is rarely an offboarding problem. It is an onboarding problem showing up late. The shared logins, personal devices, and solo sign-ups that feel harmless in a new hire’s first week are exactly what turn a resignation into weeks of cleanup and open the door to former employees keeping access they should have lost.
The fix is not complicated, and it does not require waiting for the next hire. Audit what you have, close the gaps, and build an onboarding process that makes the next exit a checklist. If your offboarding feels harder than it should, that is a clear signal your onboarding needs attention. Want help tightening both ends of the process? Reach out to our team and we will walk through it with you.
Not sure who still has access to what?
Most business owners are surprised by how much access lingers after someone leaves, and by how many tools they are still paying for. Z-JAK Technologies can audit your accounts, devices, and client communication, then build an onboarding and offboarding process that closes the gaps for good. Schedule a quick access review and stop letting old shortcuts become tomorrow’s problem.
Frequently Asked Questions
How long should offboarding take in a small business?
With good onboarding hygiene and a central identity system, the IT side of offboarding takes about 60 to 90 minutes. Without that foundation, the same task can stretch to two or three weeks of scattered cleanup as you hunt down logins, devices, and access nobody documented.
How do I find software my team signed up for without telling me?
The fastest way is a three-month review of every card statement used for business expenses. Most unapproved software shows up as a recurring charge somewhere on the card. Once you have the list, note who owns each account and whether anyone else could access it if that person left.
Can I wipe a personal device after someone leaves?
Only the company data, and only if you set that up while they were still employed. Mobile device management or managed app access lets you remove company email, files, and credentials from a personal device without touching the rest of it. If those tools were not in place during their employment, your options are limited.
What is the role of single sign-on in offboarding?
Single sign-on ties every tool a user accesses to one central identity. Disabling that identity in one place revokes access everywhere at once. Without it, someone has to log into each platform by hand and remove the user, which is slow and easy to leave incomplete.
Should I make employees use only company devices?
Where practical, yes. For personal devices, enrolling them in a management system or requiring managed app access is the next best thing. A personal device with saved company credentials and no management is the riskiest setup of all when someone leaves, since you have no way to remove your data.