Every new starter needs the right accounts, devices and access on day one, and every leaver needs that access closed on their last day. In a small business, not-for-profit or council team this job often falls to whoever is free, with no list and no record. The result is familiar: new staff waiting days for a login, shared passwords handed around, and former staff whose accounts still work months later. This guide gives South Australian small businesses, not-for-profits and councils a practical IT checklist for joiners, movers and leavers, built around Microsoft 365 and Entra ID because that is what most teams use. The same steps apply to Google Workspace and other platforms. It is general guidance, not legal or HR advice.
Why a checklist matters
Accounts that outlive the person are one of the simplest ways into an organisation. A former staff member, a contractor who finished last year or an attacker who has phished an unused account can all reach email, files and finance systems if nobody switched them off. The ACSC Essential Eight treats restricting administrative privileges and multi-factor authentication as core controls, and both depend on knowing exactly who has which account. A written onboarding and offboarding process is also something insurers, auditors and government buyers increasingly ask about. See our guide to the Essential Eight for SA SMEs for the wider picture.
Start with one trigger and one owner
The process should start from an HR or manager event, not from someone remembering to email IT. Agree a short form or ticket that captures the person's name, role, start or finish date, manager, location, which systems they need, and whether they are staff, a contractor or a volunteer. Name one owner for each step: the manager approves access, IT or your provider does the technical work, and HR or the office manager confirms it is complete. Keep the completed checklist, because it is your evidence that access was granted and removed properly.
Onboarding checklist: before day one
- Identity. Create one named account per person in Entra ID or your directory. Never share a login between staff. Use a consistent naming pattern and record the manager and department so groups and reports work.
- Role-based access. Add the person to security groups based on their role rather than copying another user's permissions, which quietly spreads access nobody remembers granting. Build a small set of role groups, such as finance, customer service and field staff, and give each group its Teams, SharePoint sites, shared mailboxes and apps.
- Least privilege. Standard accounts have no admin rights. If someone genuinely needs admin access, give them a separate admin account with stronger sign-in rules, used only for admin work.
- Licences. Assign the licence the role actually needs, ideally through group-based licensing, so cost and features stay consistent.
- Devices. Prepare a managed laptop or phone enrolled in Intune or your device management tool, with disk encryption, automatic updates, endpoint protection and your standard apps. If staff use their own phones, decide whether you manage the device or only protect work apps and data, as our guide to managing staff laptops and phones explains.
- Line-of-business systems. List the other systems the role uses, such as accounting, CRM, payroll, rostering or council property and rating systems, and request accounts in each. Use single sign-on where the system supports it, so access follows the main account.
Onboarding checklist: on day one
- Multi-factor authentication. Have the person set up MFA with IT or their manager present, before they start work. Prefer an authenticator app with number matching, or phishing-resistant methods such as passkeys or security keys, over SMS codes. The ACSC encourages phishing-resistant MFA wherever it is available.
- Password manager. Give them access to the business password manager for any shared or third-party logins, so passwords are never sent by email or chat. Our password manager and MFA rollout guide covers choosing one and setting it up.
- Short security induction. Fifteen minutes on how to spot phishing, how to report a suspicious email, how to handle personal information, which AI tools are approved, and who to call when something looks wrong. Our generative AI acceptable use policy guide covers the AI part.
- Check it works. Confirm they can reach email, files and each business system, and close the onboarding ticket with a note of what was granted.
Movers: when someone changes role
Role changes are where access quietly accumulates. When someone moves from finance to customer service, add the new role's groups and remove the old ones in the same change, rather than adding access and promising to tidy up later. Review admin rights, shared mailbox access and line-of-business permissions at the same time, and have the new manager confirm the result.
Offboarding checklist: on the last day
Agree the exact time access ends. For a planned departure that is usually the end of the final day. For a dismissal or a security concern it should be the moment the person is told, so plan it in advance with the manager and HR.
- Block sign-in and revoke sessions. Disable the account and revoke active sessions in Entra ID so existing sign-ins on phones and laptops stop working, then reset the password. Remove or reset their MFA methods.
- Remove access everywhere else. Work through the list of line-of-business systems, VPN or remote access, building access cards and alarm codes, and any third-party portals they used. Systems on single sign-on close with the main account. Those that are not need manual removal, which is why the onboarding record matters.
- Rotate shared secrets. Change any shared passwords, Wi-Fi keys, API keys or vault entries the person could see. A password manager shows you which ones they had.
- Recover devices. Collect laptops, phones, keys and security tokens. Wipe company devices before reissue, or remove company data from personal devices with your device management tool.
- Hand over email and files. Set an automatic reply that points to a colleague, and give the manager access to the mailbox and OneDrive files they need. In Microsoft 365, converting the mailbox to a shared mailbox keeps the email accessible and, within Microsoft's size limits, lets you remove the licence. By default OneDrive keeps a deleted user's files only for a limited retention period, 30 days unless you change it, so move anything important first.
- Transfer ownership. Reassign Teams, SharePoint sites, Power Automate flows, shared calendars and any cloud subscriptions or domain registrations in the person's name. Ownerless automations are a common cause of things breaking weeks later. Our domain, DNS and admin account ownership checklist explains how to keep a register of who holds what.
- Reclaim licences. Remove licences once the data is safe, so you stop paying for an account nobody uses. A regular Microsoft 365 licence review catches any that slip through.
- Record it. Close the ticket with what was removed and when.
Keep records rules in mind
Do not delete a leaver's mailbox or files just to tidy up. South Australian councils and state agencies must keep and dispose of official records under the State Records Act 1997 and the applicable disposal schedules, and many businesses and not-for-profits have their own retention duties for financial, employment and client records. Agree a retention approach for leaver data with your records or privacy lead, and use retention policies rather than manual deletion. Our guide to council records management and FOI workflows covers this in more depth.
Contractors, volunteers and shared accounts
Contractors and volunteers should follow the same process, with an end date set on the account when it is created so access expires automatically if nobody remembers. Use guest access for external collaborators where it fits, and review guests regularly. Shared logins, such as a front desk account, make it impossible to know who did what. Replace them with named accounts and shared mailboxes wherever you can.
Review access every quarter
Even a good process misses things. Once a quarter, export the list of active accounts, admin roles, guests and licences, and ask each manager to confirm their team's access. Look for accounts that have not signed in for 60 or 90 days, admin roles held by people who no longer need them, and licences assigned to disabled users. Microsoft 365 and Entra ID can produce most of these reports, and access reviews can automate parts of the job on the higher licence tiers.
Automate the repetitive parts
Once the checklist is stable, automate it. A form or HR system event can create the account, add role groups, assign licences and notify the manager, while an offboarding trigger can block sign-in, convert the mailbox and open tasks for the manual steps. Automation keeps the steps consistent and leaves an audit trail. See the secure Microsoft 365 workplace architecture and the single sign-on architecture for business apps for how identity, devices and apps fit together, and our zero trust and conditional access guide for sign-in rules.
A one-page version to start with
If you do nothing else this month, write down three lists: every system staff use, who owns access to each, and every current account with its owner. Disable anything nobody can explain. Then turn the steps above into a single page your managers can follow. If you use an outside IT provider, ask them to show you their joiner and leaver process and the records it produces. Our managed IT provider checklist lists the other questions worth asking.
This article reflects general practice as at October 2026. Product features and licence requirements change, so check current Microsoft and ACSC guidance before relying on a specific setting.
Talk to an Adelaide team
If you want a joiner, mover and leaver process set up in Microsoft 365, an access clean-up, or the repetitive steps automated, talk to us about an access and identity review or call 0402 401 584. See our managed IT and cyber security and intelligent automation services.