Module 9 of StartCloud's Microsoft 365 Security Essentials learning pathway, in five short units with a knowledge check: why the ex-employee account nobody closed is a live security risk, setting up new starters by role rather than copying an existing user, the six-step leaver checklist in the correct order (block sign-in and sign out sessions first, convert the mailbox to shared, hand over files, then reclaim the licence), and the awkward cases including personal phones, shared logins, contractors and sudden departures.
Starters and Leavers: Closing the Door Properly
The account nobody closed
Every module before this one has been about keeping the wrong people out. Strong sign-in, protected admins, filtered mail, controlled sharing, shaped access, classified data. All of it points outward.
This module is about a door that opens from the inside, and it is the one most businesses forget to close. Somebody leaves. Their laptop comes back, their farewell card gets signed, and their account keeps working perfectly. Mail still arrives. Files are still reachable. The phone in their pocket still syncs company email on the drive home.
A live login with a password that has not changed, sitting outside your building and outside your control. If that password turns up in a breach at their next employer, or on a personal service where they reused it, an attacker gets a working account with real permissions and nobody watching it.
The opposite mistake, and it costs just as much. Delete the account on the last day and you have started a 30 day clock on their mailbox and their OneDrive. Miss it, and the client history, the quotes and the half-finished handover go with it, permanently.
It usually lives on somebody's mental checklist somewhere between the exit interview and returning the parking pass, which is exactly why it gets missed on a busy fortnight. Treat it the way you treat MFA: written down, done the same way every time, and not dependent on anyone remembering.
The good news is that the fix is not complicated. It is a short list done in the right order, and the order genuinely matters. Most businesses that get this wrong are not lazy, they simply do the right steps in the wrong sequence and lose something along the way.
We will do starters first, because a tidy leaver process is much easier when the account was set up sensibly in the first place.