Skip to content

Procedure

Joiner & Leaver Procedure

Same checklist, every time. Stops “why does Sam still have access” three years later.

Most access problems start with inconsistent joiner and leaver processes. This is a procedure, not a policy — a checklist that runs every time someone joins or leaves.

How to use this: The bracketed items like [Company Name] are placeholders — replace them with your own details. Edit the wording to suit your business. This is a starter, not legal advice.

New joiner — pre day-1

  • Account created (Microsoft 365 / Google), correct licence.
  • Role decided — RBAC group assigned. Access by role, not by cloning a colleague.
  • Hardware provisioned: laptop encrypted, EDR installed, OS patched, MDM enrolled.
  • MFA enrolment instructions ready.
  • Welcome doc ready (tools, who's who, how to ask for help, link to Information Security Policy).

New joiner — day 1

  • MFA enrolled — authenticator app, not SMS.
  • Password manager invited and accepted.
  • Walked through: Acceptable Use, Password, AI Acceptable Use policies.
  • Added to relevant Teams, SharePoint sites, shared inboxes.
  • Email signature set up.

New joiner — first week

  • 15-minute phishing & social engineering briefing.
  • Access audit: confirmed they have only what they need.
  • Added to the tools register.
  • Signed acknowledgement of policies on file.

Leaver — one week before

  • Map every system they have access to.
  • Identify files, dashboards, shared inboxes they own. Brief their manager on handover.
  • Plan email forwarding — who, for how long.

Leaver — day of departure

  • Microsoft 365 / Google account disabled (not deleted — you may need the mailbox).
  • MFA enrolment revoked.
  • All sessions signed out.
  • Shared / admin passwords they knew are changed.
  • Email forwarding set to manager.
  • Company devices collected and reset; BYOD work container wiped.
  • Building access (keys, fobs, alarm code) revoked.
  • Removed from external supplier systems and SaaS tools.

Leaver — within a week

  • Shared-drive / SharePoint ownership reassigned.
  • External SaaS deactivations completed (Xero, HubSpot, Mailchimp, etc.).
  • Suppliers notified to update contact records.
  • Tools register updated.

Leaver — after 30 days (or per retention policy)

  • Email forwarding turned off.
  • Mailbox archived per retention.

Sign-off

Each joiner and leaver process is signed off by [Named Manager]. A copy of the completed checklist is filed against the employee record.

Tips for adoption

  • Use the same checklist every time, even for short-term contractors.
  • Disable, don't delete — you often need the mailbox.
  • Audit external SaaS — they're the most commonly forgotten.