Article Summary: Employee offboarding is the final step of a process that started on the employee’s first day. Shared logins, forgotten SaaS subscriptions, untracked personal devices, and client relationships locked inside one person’s inbox can almost always be traced back to informal onboarding shortcuts taken months earlier. Tightening the onboarding side turns each future departure into a 90-minute checklist instead of a three-week cleanup.

By the time an employee hands in their notice, the decisions that will make their departure clean or messy have already been made. They were made in the first weeks of the person’s tenure, when nobody was paying close attention because the new hire had just arrived and there were a hundred other things to do. A shared login here, a quick SaaS sign-up there, a personal laptop used until the company hardware arrived. By month six, none of those feel like decisions at all. They feel like how things are.

At Pacific Edge Technology, we support businesses across Richland, Kennewick, and Pasco, and messy employee offboarding is one of the most common gaps we find when we take over a new client’s environment. This post covers what’s really going wrong when offboarding takes three weeks, the four onboarding shortcuts that guarantee a painful exit, how to fix things for the team you already have, and what your IT provider should be doing at onboarding that probably isn’t happening.

What’s really going wrong when employee offboarding takes three weeks

A clean offboarding takes about 90 minutes of IT time. The account is disabled in your identity provider, which revokes access across every tool connected through single sign-on. The device is remotely wiped, or collected and wiped on-site. Email is forwarded to a manager or converted to a shared mailbox. The departing person’s accounts in your CRM and project tools are reassigned. A handover note, already templated because it was set up at onboarding, gets filled in and filed.

The messy version of the same process can take three weeks. It starts with a manual list of tools nobody can fully remember, which usually means asking the departing employee to help reconstruct it. You find a Figma account, a Loom workspace, a Notion instance, and an Airtable base, all set up independently, all with passwords sitting in the departing employee’s personal password manager. The laptop is at their house and they’re not in any rush to return it. A client emails to say they received a strange message from a personal address. Six weeks later, a vendor charges the company card for a seat you thought you cancelled.

Whether your employee offboarding is clean or chaotic depends on what was set up during onboarding.

In the identity management world, this is called the “joiner, mover, leaver” lifecycle. Microsoft and most identity vendors use the same three-phase model. A rushed joiner phase pushes months of identity cleanup into the two weeks after the resignation lands.

Four onboarding shortcuts that guarantee a messy exit

1. Letting new hires sign up for SaaS tools on their own

When a staff member signs up for a tool independently, using their work email and a password only they know, that account is functionally theirs. You can’t reset it without triggering a notification to them. You may not even know the account exists until a vendor invoice shows up, or until the account goes dark after they leave and a client project breaks.

This is the most common source of the “we can’t find half the logins when someone leaves” problem. The fix is provisioning every tool through a central identity system, so any new SaaS application gets connected to your single sign-on before the first user logs in.

2. Tolerating personal devices “just until we get them sorted”

Personal devices used for work rarely stay temporary. The employee installs apps, connects to client systems, and downloads files, and the stopgap becomes the way they work. When they leave, you have no ability to wipe company data from a device you don’t own and never enrolled in a management system. You’re relying on their goodwill, which is usually fine, but goodwill is not a security control.

The fix is to issue company-owned devices on day one and enroll them in mobile device management. When you do allow a personal device, require managed app access for company email and files. Browser-saved credentials are not a substitute.

3. Shared logins for tools you didn’t want to pay per-seat for

Shared credentials are the worst offender at offboarding. When five people use the same login for a tool, you can’t remove one person’s access without changing the password for everyone. You usually discover this at the worst possible time, when the person leaving is the one who set up the account and nobody else remembers the password.

Paying per seat is the cost of doing this properly. The money you saved with shared logins comes back during offboarding as wasted hours and exposed access.

4. Letting client relationships live in one person’s inbox

This one hits professional services firms, agencies, engineering and consulting firms, and any business where staff manage client accounts. When a senior account manager or project lead leaves, their client relationships often leave with them. The context, the email history, the preferences, and the half-finished threads all lived in one person’s inbox. Once that person is gone, all of it becomes inaccessible or awkward to retrieve.

From the client’s side, it feels like your business suddenly doesn’t know who they are.

The fix is a shared inbox or CRM where client communication is logged. Even a Microsoft 365 shared mailbox, with a clear expectation that client threads are CC’d to it, is a meaningful improvement over what most small businesses have today.

How to fix things for the team you already have

Most businesses need to clean up the team they already have, ideally before the next hire arrives. You can’t go back and re-onboard your existing staff, but you can audit what’s there and close the gaps before the next departure.

The SaaS audit

Pull three months of statements from every credit card used for business expenses and list every recurring SaaS charge. For each one, find out who set it up, who has the login, whether the account uses a personal or company email, and whether anyone else could access it if that person left tomorrow.

You’ll find tools nobody remembers signing up for, tools used by one person with no backup access, and accounts where the original owner has already left while you’re still paying for the seat. None of this is technical. All it takes is a spreadsheet and an afternoon.

The device register

Build a simple list: who has what, when each device was issued, whether it’s enrolled in a management system, and what company data it can access. Ask every staff member to confirm the devices they use for work, including personal ones. The goal is simply to map what you’re working with, and most employees are happy to help once they know nothing punitive will come of it.

For any personal device that has been used to access company systems, the minimum standard is making sure company email and file access happens through managed apps that can be remotely disconnected.

Client communication in shared places

Move client communication into shared places so the relationship belongs to the business, not to an individual. Set up a shared inbox or alias for client-facing communication, and use a CRM where contact history and notes are logged. The goal is continuity: when someone moves on, the next person can pick up the thread without the client noticing a gap.

What your IT provider should be doing at onboarding

Most IT providers only get called when someone resigns. They show up, disable the account, collect the laptop if they can find it, and do their best with whatever documentation exists. That’s the wrong end of the lifecycle. If that’s the only time your IT provider is involved in staff transitions, you’re missing much of the value the relationship should provide.

The model that works puts your IT provider at onboarding too. They set up the new account in your identity provider, enroll the device in mobile device management, and provision access through single sign-on, so every tool the new hire uses is tied to a central identity that can be switched off in one action. They should also maintain a handover document for each staff member, updated periodically, listing every system the person accesses, every client relationship they own, and every credential tied to their identity. This is the model Pacific Edge Technology follows with every client, for exactly this reason.

When that foundation is in place, employee offboarding becomes a checklist and an hour rather than a three-week excavation. Ask your IT provider what they do at onboarding. If the answer is “not much” or “we usually just get called when someone leaves,” that’s worth a conversation.

A 60-day plan before your next departure

You don’t need to know when the next resignation will land to get started. In fact, the work is far easier when nothing is urgent.

Weeks 1 and 2: Run the credit card SaaS audit. Build a list of every tool, every account owner, and every login that only one person controls. Flag the ones where access would be lost or complicated if that person left this week.

Weeks 3 and 4: Build the device register. Confirm what every staff member uses for work. For personal devices with company access, implement managed app access at minimum. Enroll company-owned devices in a management system if they aren’t already.

Weeks 5 and 6: Audit client-facing communication. Identify any client relationships that live mainly in one person’s inbox or on someone’s mobile phone. Set up shared mailboxes or CRM logging for the highest-risk accounts first.

Weeks 7 and 8: Write the onboarding process you wish you’d had, using everything you found in the previous six weeks. Apply it to your next hire from day one, and use it as the template for a handover document for every existing staff member.

Most of this is an operational task rather than a technology project. A spreadsheet, some honest conversations with your team, and a few hours of your IT provider’s time will cover the bulk of it.

If you’re a Tri-Cities business and would rather have someone run this audit for you, get in touch with Pacific Edge Technology. We’ll help you find the gaps now, so your next employee offboarding takes an hour instead of three weeks.

Employee Offboarding FAQs

How long should employee offboarding take in a small business?

With good onboarding habits and centralized identity, the IT side of employee offboarding takes about 60 to 90 minutes. Without that foundation, the same task can stretch into two or three weeks of scattered cleanup.

How do I find SaaS tools my team signed up for without telling me?

The fastest way is to review three months of statements for every credit card used for business expenses. Most unapproved SaaS shows up as a recurring charge somewhere on a card.

Can I wipe a personal device after someone leaves?

Only the company data, and only if you set that up while they were still employed. Mobile device management or managed app access lets you remove company email, files, and credentials from a personal device without touching anything else on it. If those tools weren’t in place during their employment, your options are limited.

What role does single sign-on play in offboarding?

Single sign-on ties every tool a user accesses to one central identity. Disabling that identity in one place revokes access everywhere. Without single sign-on, someone has to log into each platform manually and remove the user.

Should I require employees to use only company devices?

Where practical, yes. For personal devices, enrolling them in a management system or requiring managed app access is the next best option. A personal device with saved company credentials and no management is the highest-risk setup when someone leaves.

Article used with permission from The Technology Press.