Offboarding the last day: the accounts, keys and devices a ten-person company takes back when someone leaves
Five dated cases where a leaver's access stayed on, an eight-item leaver sheet, the last day hour by hour (money and admin first), what Google Workspace (20 days) and Microsoft 365 (30, 60, 93 and 365 days) do with a removed user's mail and files, and what a forgotten account costs, from $0 to a $150 OneDrive reactivation.
In October 2022 a quality-assurance engineer was let go by NCS, a large IT services firm in Singapore. A few weeks later, back home, he found that his old login still worked. On 18 and 19 March 2023 he used it to run a script that deleted 180 virtual servers in the company's test system. The clean-up cost about S$918,000 (roughly US$678,000), and in June 2024 he was jailed for two years and eight months. NCS put the open account down to human oversight.
A ten-person company is unlikely to employ a saboteur. What it does have is the same gap, only quieter: the leaver's phone still gets the six-digit code for the company bank, the Stripe secret key sits in a .env file on a laptop that went home with them, four subscriptions are billed to a card in their name, and the domain registrar's recovery email is their personal Gmail. Nobody means harm, and none of it gets noticed until something renews, fails or gets reset.
This is the last-day routine for a small business: what to inventory before the day, what to switch off and in which order, what Google Workspace and Microsoft 365 actually do with a removed user's mail and files (the day counts are short), and what it costs to leave an account running. If your shared logins are still in a spreadsheet, start with who can see the company's shared passwords; this article assumes the vault exists and covers everything around it.
What happens when access stays on
Five cases from the court records and company filings of the last few years. Not one needed a clever attack; each used access that was never taken away, or that the person was able to keep.
Two lessons for a small company. First, three of the five were plain credentials nobody revoked, the cheapest problem there is to fix. Second, the person with admin rights gets a different order of steps: in the Vituity case the password was changed after he learned he was leaving, and in the Eaton case the trap was set off by disabling his account. For anyone who holds the keys to the kingdom (the registrar, the email admin, the cloud console, the bank), rotate the shared admin credentials and check what runs under their account before or at the moment you tell them, not after.
Surveys of how common this is are old and vendor-run (the most quoted one, a poll of about 1,000 US workers, found almost half saying a former employer's password still worked for them), so we won't lean on them. The cases above are enough.
Before the day: the leaver sheet
The routine below only takes an hour if someone has written down what the person has. In a ten-person business, that is rarely more than one page, and building it takes about 20 minutes with the person still in the building. These are the eight places to look and where to find what's in each.
Item 6 is the one that bites later. Automations created by a user generally belong to that user, and many stop when the account is suspended or deleted: the monthly invoice script, the form that files leads into the CRM, the booking page on the website. Move each one to a shared or service account while the person can still show you how it works.
The last day, hour by hour
Order matters more than speed. Money and admin access first, then the main account, then everything that hangs off it. The times below assume the person is told in the morning and leaves at the end of the day; for a sudden departure, do the first two blocks at once.
Two of these deserve a sentence more. On Microsoft's side, Block sign-in can take up to 24 hours to apply, which is why its own guide says to reset the password first. On Google's side, suspension is the right first move because it is reversible and keeps the data, but it is billed like an active seat, so it shouldn't become the final state.
The domain is the account most likely to have been set up years ago by someone who has since left. Our article on who owns the domain has the registrar handover checklist and what it costs to recover an expired name.
What Google Workspace does with a removed user
Google's own advice is to transfer Gmail, Drive and calendar data before deleting, take group calendars off the person first (they can't be transferred once the owner is gone), remove any admin role, and lift any Vault hold, since a user on hold can't be deleted. A super admin can transfer Drive files and the primary calendar as part of the delete dialog itself; Gmail has to be moved by migration or forwarding beforehand.
What Microsoft 365 does with a removed user
The OneDrive manager hand-off only works if the person's manager is filled in on their profile, or a secondary owner is set in the SharePoint admin center. In a small company neither is often true, and then nobody gets access or the warning. Set both now, before anyone leaves.
What leaving it on costs: worked through
Take one person who left and whose account nobody touched for six months. Prices are US list prices in October 2026: Google Workspace Business Standard $14 a user a month on an annual plan or $16.80 on the flexible plan; Microsoft 365 Business Standard $14 a month at renewals after the 1 July 2026 increase (it was $12.50); Slack Pro $8.75.
The licence money is small. The expensive case is the forgotten OneDrive. Say a leaver's 250 GB OneDrive was left unlicensed and, five months later, someone needs a contract that lived in it. By then it is archived. Reactivating it costs 250 x $0.60 = $150 once, and switching on the billing that reactivation needs starts $0.05 per GB a month for every archived unlicensed OneDrive in the tenant: $12.50 a month for this one alone. If the user account still exists, there's a cheaper way back: assign a licence ($14 for the month) and the OneDrive comes back within about two days with no reactivation fee. If the account was deleted, that route is gone. Either way, moving the files in the first week costs nothing.
On Google's side the cliff is sharper: 20 days after deletion, files the person owned alone are gone for good unless you transferred them or pay for an archive or third-party backup. There is no paid way back.
Keep a one-page record
For each leaver, keep the sheet with a date and a tick for each of the eight items, who did it, and where the data went. It takes five minutes and pays back three times: when a customer emails the old address in March, when the cyber insurer asks how you remove leavers, and when the next person leaves and you can copy the list.
Leavers also change who is allowed to approve a payment, which is when fraudsters like to call. If your payment rule names people, update it the same day; the reasons are in a cloned voice asks for a wire.
Every leaver leaves tools behind: seats nobody uses, subscriptions on a card that's about to be cancelled, apps with no owner. List the company's subscriptions to see empty seats, duplicates and tools without an owner, with a cancel-by calendar. Runs in your browser.
Open the software spend checkSources
Cases: Channel NewsAsia via Slashdot and ACS Information Age on NCS (Jun 2024); Engadget and Decrypt on Block's April 2022 filing, Paubox on the $15 million settlement (the settlement also covered other unauthorised account activity); US Attorney, Northern District of California and Patch on the Vituity case; The Hacker News on the Eaton kill switch (Aug 2025); US Attorney, Southern District of Iowa and BleepingComputer on the Saydel case; Dark Reading on the PasswordManager.com poll.
Google Workspace (read 25 Oct 2026): delete a user, suspend a user, archive former employees; Archived User price from a UK G-Cloud reseller price list (Jan 2026); US list prices as reported by EmailVendorSelection (2026).
Microsoft 365 (read 25 Oct 2026): remove a former employee, step 1: block sign-in, step 4: shared mailbox, OneDrive retention and deletion, unlicensed OneDrive accounts (Aug 2026); July 2026 price change from The Register and Nerdio.
Other: Slack fair billing policy; Apple on Activation Lock; worked costs are our arithmetic from the prices above.