Your newest hire just started Monday. By Friday, they’ve signed up for three SaaS tools with their work email and personal passwords, they’re using their own laptop because the company one hasn’t arrived yet, and they’re sharing a login with a coworker for a tool you didn’t want to pay per-seat for. Nobody thinks twice about any of it. Six months from now, when that employee puts in their notice, every single one of those shortcuts becomes your problem.
Here’s the thing most Bradenton business owners don’t realize: messy offboarding isn’t an offboarding problem. It’s an onboarding problem that’s been quietly growing for months. Let’s walk through what’s actually going wrong, the four shortcuts that guarantee a painful exit, and how to fix it — even for the team you already have.
Why Offboarding Turns Into a Three-Week Nightmare
A clean offboarding takes about 90 minutes of IT time. Disable the account in your identity provider, which cascades access revocation across every tool connected via single sign-on. Remotely wipe or collect the device. Forward email to a manager. Reassign their accounts in your CRM and project tools. Done.
The messy version? Three weeks, easy. It starts with a manual list of tools nobody can fully remember — which usually means asking the departing employee to help reconstruct it. You discover a Figma account, a Loom workspace, a Notion instance, all set up independently, all with passwords in the departing employee’s personal password manager.
The laptop is at their house and they’re in no rush to return it. A client emails to say they got a strange message from a personal address. Six weeks later, a vendor charges the company card for a seat you thought you cancelled.
Whether your offboarding is clean or chaotic was decided months ago, during onboarding. In the identity management world, this is called the “joiner, mover, leaver” lifecycle — a framework Microsoft and most identity vendors use. A rushed joiner phase compresses months of identity cleanup into the two weeks after a resignation lands.
Four Onboarding Shortcuts That Guarantee a Painful Exit
1. Letting new hires sign up for tools on their own
When a staff member signs up for a tool independently — using their work email and a password only they know — that account is functionally theirs. You can’t reset it without triggering a notification to them. You may not even know the account exists until a vendor invoice shows up or a client project breaks after they leave.
This is the number one source of the “we can’t find half the logins when someone leaves” problem. The fix? Provision every tool through a central identity system. Any new SaaS application gets connected to your single sign-on before the first user logs in.
2. Personal devices “just until we get them sorted”
Personal devices used for work don’t stay temporary. The employee installs apps, connects to client systems, downloads files — and what was a temporary fix becomes how they work permanently. When they leave, you have no ability to wipe company data from a device you don’t own and never enrolled in a management system.
We see this constantly with Tampa Bay accounting firms and law offices that hire quickly during busy season. The fix: issue company-owned devices on day one and enroll them in mobile device management. If you do allow a personal device, require managed app access for company email and files.
3. Shared logins to save on per-seat costs
Shared credentials are the worst offender at offboarding. When five people use the same login, you can’t remove one person’s access without changing the password for everyone. You usually discover this at the worst possible time — when the person leaving is the one who set up the account and nobody else remembers the password.
Per-seat licensing is the cost of doing this properly. The savings from shared logins always reappear during offboarding as wasted hours and exposed access.
4. Client relationships living in one person’s inbox
This one hits especially hard for professional services firms — CPAs, financial advisors, attorneys, wealth management practices. When a senior advisor or consultant leaves, their client relationships often walk out the door with them. The context, email history, preferences, and half-finished threads all lived in one person’s inbox.
From the client’s perspective, your business just forgot who they are. The fix is a shared inbox or CRM where client communication gets logged. Even a Microsoft 365 shared mailbox with a clear expectation that client threads are CC’d to it is a massive improvement over what most small businesses have today.
How to Fix This for the Team You Already Have
You can’t go back and re-onboard your existing staff. But you can audit what’s there and close the gaps before the next departure catches you off guard.
The SaaS audit
Pull three months of credit card statements — every card used for business expenses — and list every recurring SaaS charge. For each one, find out who set it up, who has the login, whether it uses a personal or company email, and whether anyone else can access it if that person left tomorrow.
You’ll find tools nobody remembers signing up for, tools used by one person with no backup access, and accounts where the original owner already left while you’re still paying for the seat. This isn’t a technical exercise. It takes a spreadsheet and an afternoon.
The device register
Build a simple list: who has what, when it was issued, whether it’s enrolled in a management system, and what company data it can access. Ask every staff member to confirm the devices they use for work, including personal ones. Most people are happy to share once they know nothing punitive will come of it.
For any personal device that’s been used to access company systems, the minimum is making sure company email and file access happens through managed apps that can be remotely disconnected.
Get client communication into shared spaces
Move client communication into shared places so the relationship belongs to the business, not the individual. Set up a shared inbox or alias for client-facing communication and use a CRM where contact history and notes are logged. For Florida financial advisory firms and accounting practices, this isn’t just good hygiene — it’s a business continuity issue.
What Your IT Provider Should Be Doing at Onboarding
Most IT providers get called when someone resigns. They disable the account, collect the laptop if they can find it, and do their best with whatever documentation exists. That’s the wrong end of the lifecycle to get involved.
The model that actually works puts your IT provider at onboarding too. They set up the new account in your identity provider, enroll the device in mobile device management, and provision access through single sign-on — so every tool the new hire uses is connected to a central identity that can be switched off in one action. They also maintain a handover document for each staff member listing every system, every client relationship, and every credential tied to their identity.
When that’s in place, offboarding becomes a checklist and an hour instead of a three-week excavation. Ask your IT provider what they do at onboarding. If the answer is “not much” or “we usually just get called when someone leaves,” that’s worth a conversation.
A 60-Day Plan Before Your Next Departure
You don’t need to know the exact date of the next resignation to start. This work is way more manageable when nothing is urgent.
Weeks 1–2: Run the credit card SaaS audit. Build a list of every tool, every account owner, and every login that only one person controls. Flag the ones where access would be lost if that person left this week.
Weeks 3–4: Build the device register. Confirm what every staff member uses for work. For personal devices with company access, implement managed app access at minimum. Enroll company-owned devices in a management system if they aren’t already.
Weeks 5–6: Audit client-facing communication. Identify any client relationships that exist primarily in one person’s inbox or on their mobile phone. Set up shared mailboxes or CRM logging for the highest-risk accounts first.
Weeks 7–8: Write the onboarding process you wish you’d had. Use everything you found in the previous six weeks as input. Apply it to your next hire from day one, and use it as the template for a handover document for every existing staff member.
Most of this is operational work, not a technology project. A spreadsheet, some honest conversations with your team, and a few hours of IT time will cover the bulk of it.
Frequently Asked Questions
How long should offboarding take in a small business?
With proper onboarding hygiene and centralized identity, the IT side of offboarding takes about 60 to 90 minutes. Without that foundation, the same task can stretch to two or three weeks of scattered cleanup.
How do I find SaaS tools my team signed up for without telling me?
The fastest way is a three-month review of every credit card statement used for business expenses. Most shadow SaaS shows up as a recurring charge somewhere on the card.
Can I wipe a personal device after someone leaves?
Only the company data, and only if you set that up while they were still employed. Mobile device management or managed app access lets you remove company email, files, and credentials from a personal device without touching the rest of it. If those tools weren’t in place during their employment, your options are limited.
What’s the role of single sign-on in offboarding?
Single sign-on means every tool a user accesses is tied to a central identity. Disabling that identity in one place revokes access everywhere. Without it, you have to manually log into each platform and remove the user one by one.
Should I make my employees use only company devices?
Where practical, yes. For personal devices, enrolling them in a management system or requiring managed app access is the next best thing. A personal device with saved company credentials and no management is the highest-risk configuration for offboarding.
Sources and Further Reading
- Microsoft Learn: What are lifecycle workflows in Microsoft Entra? — Microsoft’s framing of the joiner/mover/leaver lifecycle and the workflows that automate it.
- Microsoft Learn: App Protection Policies overview (Intune) — how managed app access works for personal devices, including selective wipe of company data.
If your offboarding process feels harder than it should be, that’s a signal your onboarding needs attention. We help businesses across Bradenton and Tampa Bay get both ends of the employee lifecycle locked down — so the next resignation is a checklist, not a crisis. Book a free 15-minute call and let’s walk through what needs tightening.
