Joiner and leaver: what IT must handle in an SME

Why joiner and leaver fail without a checklist

In an SME a starter often “just” begins on a shared laptop or a temporary password sent via WhatsApp. On exit the mailbox stays open, MFA still sits on the leaver’s phone, or they still reach a shared Drive. That is usually missing ownership — not malice.

A short, repeatable checklist prevents it. You do not need an enterprise process; you do need someone who ticks the same steps on day one and on the last day.

Joiner checklist

On or before the first working day:

• Create the account in Google Workspace or Microsoft 365 with a strong starter password and MFA from the first login;
• assign the right groups and shared drives/SharePoint libraries — not “everything open”, only what the role needs;
• assign the licence (mail, Office, any extras) and note which seat it is;
• prepare the device: patching, endpoint under management, workplace protection per your MSP package;
• mailbox ready, plus any welcome mail from HR or the manager;
• make the ticket portal clear, so the starter does not mail a private inbox.

Leaver checklist

On or before the last working day — planned, not after “we are missing data”:

• Block or suspend the account; reset passwords; revoke MFA methods;
• mailbox: forward or delegate to a successor, then archive per your retention rule;
• shared Drive/SharePoint: transfer ownership, check personal folders;
• release licences;
• remove the device from management, wipe or reimage;
• physical access: badge, key, alarm code if any;
• hand open tickets to a colleague or the MSP; no orphaned tickets on a departed named user.