By the time an employee hands in their notice, the decisions that will make their departure clean or messy have already been made. They were made in the first weeks of that person’s tenure, during employee onboarding offboarding planning, when nobody was paying close attention because the new hire had just arrived and there were a hundred other things to do. A shared login here, a quick SaaS sign-up there, a personal laptop used until the company hardware arrived. By month six, none of those feel like decisions at all. They feel like how things are.
This post covers what’s really going wrong when the employee onboarding offboarding cycle takes three weeks instead of ninety minutes, the four shortcuts that guarantee a painful exit, and how to retrofit hygiene on the team you already have.
Employee Onboarding Offboarding: Why the Gap Is 90 Minutes vs. Three Weeks
A clean offboarding takes about 90 minutes of IT time. An account is disabled in your identity provider, which cascades access revocation across every tool connected via single sign-on. The device is remotely wiped or collected and wiped on-site. Email is forwarded to a manager or converted to a shared mailbox. The departing person’s accounts in your CRM and project tools are reassigned. A handover note, already templated because it was templated at onboarding, gets filled in and filed.
The messy version of the same process can take three weeks. It starts with a manual list of tools nobody can fully remember — which usually means asking the departing employee to help reconstruct it. You find a Figma account, a Loom workspace, a Notion instance, and an Airtable base, all set up independently, all with passwords sitting in the departing employee’s personal password manager. The laptop is at their house and they’re not in any rush. A client emails to say they received a strange message from a personal address. Six weeks later, a vendor charges the company card for a seat you thought you cancelled.
Whether your employee onboarding offboarding process is clean or chaotic depends almost entirely on what was set up during the first two weeks. In the identity management world, this is called the joiner, mover, leaver lifecycle — the model Microsoft and most identity vendors use. A rushed joiner phase compresses months of identity cleanup into the two weeks after the resignation lands.
Four Onboarding Shortcuts That Guarantee a Messy Exit
1. Letting New Hires Sign Up for SaaS Tools on Their Own
In an employee onboarding offboarding context, when a staff member signs up for a tool independently — using their work email and a password only they know — that account is functionally theirs. You can’t reset it without triggering a notification to them. You may not even know the account exists until a vendor invoice shows up, or until the account goes dark after they leave and a client project breaks.
This is the most common source of the “we can’t find half the logins when someone leaves” problem. The fix is provisioning every tool through a central identity system, where any new SaaS application gets connected to your single sign-on before the first user logs in. For Southeast Texas businesses building a proper employee onboarding offboarding process with Microsoft 365 or Google Workspace, this infrastructure is already available — it just needs to be used consistently from day one.
2. Tolerating Personal Devices “Just Until We Get Them Sorted”
One of the most common employee onboarding offboarding mistakes: personal devices that get used for work don’t stay temporary. The employee installs apps, connects to client systems, downloads files, and what was a temporary fix becomes how they work permanently. When they leave, you have no ability to wipe company data from a device you don’t own and never enrolled in a management system. You’re relying on their goodwill — which is usually fine, but it is not a security control.
The fix is to issue company-owned devices on day one and enroll them in mobile device management. When you do allow a personal device, require managed app access for company email and files. Browser-saved credentials on a personal device are not a substitute for proper device enrollment.
3. Shared Logins for Tools You Didn’t Want to Pay Per-Seat For
Shared credentials are the worst offender at offboarding time. When five people use the same login for a tool, you can’t remove one person’s access without changing the password for everyone. You usually find this out at the worst possible moment — when the person leaving is the one who set up the account and nobody else remembers the password at all.
Per-seat licensing is the cost of doing employee onboarding offboarding properly — the only version that actually works. The savings from shared logins reappear during offboarding as wasted hours, exposed access, and accounts that stay open because nobody can figure out how to close them without breaking something.
4. Letting Client Relationships Live in One Person’s Inbox
This one is specific to agencies and professional services. When a senior account manager or consultant leaves, their client relationships often leave with them. The context, the email history, the preferences, and the half-finished threads lived in one person’s inbox. With the person gone, all of that becomes inaccessible or awkward to retrieve — and from the client’s side, your business just doesn’t know who they are anymore.
The fix is a shared inbox or CRM where client communication is logged. Even a Microsoft 365 shared mailbox with a clear expectation that client threads are CC’d to it is a meaningful improvement over what most Southeast Texas small businesses have today.
How to Retrofit Hygiene on the Team You Already Have
The employee onboarding offboarding cleanup most businesses need starts with the team they already have — before the next hire arrives. You can’t go back and re-onboard existing staff, but you can audit what’s there and close the gaps before the next departure.
The SaaS Audit
Pull three months of credit card statements — every card used for business expenses — and list every recurring SaaS charge. For each one, find out who set it up, who has the login, whether the account uses a personal or company email, and whether anyone else can access it if that person left tomorrow.
You’ll find tools nobody remembers signing up for, tools used by one person with no backup access, and accounts where the original owner has already left while you’re still paying for the seat. None of this is a technical exercise. All it takes is a spreadsheet and an afternoon.
The Device Register
Build a simple list: who has what device, when each was issued, whether it’s enrolled in a management system, and what company data each device can access. Ask every staff member to confirm the devices they use for work, including personal ones. For any personal device that has been used to access company systems, the minimum is making sure company email and file access happens through managed apps that can be remotely disconnected.
Client Communication in Shared Places
In an employee onboarding offboarding context, moving client communication into shared places ensures the relationship belongs to the business when an individual moves on. Set up a shared inbox or alias for client-facing communication, and use a CRM where contact history and notes are logged. This is continuity infrastructure — it protects the client relationship and your revenue when any team member leaves, not just when someone exits badly.
What Your IT Provider Should Be Doing at Onboarding
Most IT providers get called when someone resigns. They show up, disable the account, collect the laptop if they can find it, and do their best with whatever documentation exists. That’s the wrong end of the employee onboarding offboarding lifecycle to be primarily involved in to be primarily involved in.
The model that works puts your IT provider at onboarding too. They set up the new account in your identity provider, enroll the device in your mobile device management system, and provision access through single sign-on so every tool the new hire uses is connected to a central identity that can be switched off in one action. CISA’s offboarding guidance identifies centralized identity management as the single most effective control for reducing offboarding risk — and it starts at onboarding, not at resignation.
They should also maintain a handover document for each staff member, updated periodically, listing every system the person accesses, every client relationship they own, and every credential tied to their identity. When that’s in place, offboarding becomes a checklist and an hour rather than a three-week excavation.
A 60-Day Plan to Fix Your Employee Onboarding Offboarding Process
You don’t need to know the exact date of the next resignation to start. The work is more manageable when nothing is urgent.
- Weeks 1–2: Run the credit card SaaS audit. Build a list of every tool, every account owner, and every login that only one person controls.
- Weeks 3–4: Build the employee onboarding offboarding device register. For personal devices with company access, implement managed app access at minimum.
- Weeks 5–6: Audit client-facing communication. Set up shared mailboxes or CRM logging for the highest-risk accounts first.
- Weeks 7–8: Write the employee onboarding offboarding process you wish you’d had. Apply it to your next hire from day one and use it as the template for a handover document for every existing staff member.
Most of this is an operational task rather than a technology project. Fixing the employee onboarding offboarding gap doesn’t require a major project. A spreadsheet, some honest conversations with your team, and a few hours of your IT provider’s time will cover the bulk of it. If you’d like help building a proper employee onboarding offboarding process for your Southeast Texas business, our managed IT services include onboarding and offboarding workflow setup — schedule a free IT checkup to get started.
Frequently Asked Questions: Employee Onboarding Offboarding
How long should employee onboarding offboarding take in a small business? With proper onboarding hygiene and centralized identity management, the IT side of offboarding takes about 60 to 90 minutes. Without that foundation, the same task can stretch to two or three weeks of scattered cleanup — chasing logins, tracking down devices, and cancelling subscriptions one by one.
How do I find SaaS tools my team signed up for without telling me? The fastest way is a three-month review of every credit card statement used for business expenses. Most shadow SaaS shows up as a recurring charge somewhere. A full zombie SaaS audit — cross-referencing subscriptions against current staff — closes the gap more thoroughly.
Can I wipe a personal device after someone leaves? Only the company data, and only if you set that up while they were still employed. Mobile device management or managed app access lets you remove company email, files, and credentials from a personal device without touching the rest of it. If those tools weren’t in place during their employment, your options are limited.
What’s the role of single sign-on in employee onboarding offboarding? Single sign-on means every tool a user accesses is tied to a central identity. Disabling that identity in one place revokes access everywhere connected to it. Without single sign-on, you have to manually log into each platform and remove the user — which is how three-week offboarding happens.
Should I require company devices as part of my employee onboarding offboarding policy? Where practical, yes. For personal devices, enrolling them in a management system or requiring managed app access is the next best option. A personal device with saved company credentials and no management enrollment is the highest-risk configuration for offboarding.
Article used with permission from The Technology Press.
