# How to Close Off a Departing Employee's Email Access > When and how should a departing employee's email and file access be closed off; who inherits the mailbox and files? A step-by-step checklist. Source page: https://dblinx.net/en/rehberler/calisan-ayrilinca-erisim-kapatma --- Administration # How to revoke email access for a departing employee? A step-by-step access revocation guide A departing employee's email access should be revoked on their last day, their sessions ended, and their correspondence handed over to a colleague. Shared mailbox and file permissions are also revoked the same day. Being able to revoke access from a single list across all services removes the risk of a forgotten account. 6 min readPublished: 24.09.2026Updated: 29.09.2026 ## Why should access be closed on the day someone leaves? An account left open carries two distinct risks. The first is deliberate misuse: the departing person may still be able to access customer lists, quotes or contracts. The second is more common and harder to notice: when the password for an account no one's tracking anymore leaks, the attacker gains an address that looks like it comes from inside the organization, and mail sent from that address looks trustworthy to suppliers and customers. Mail also keeps arriving at that address after the person has left. If a customer's order request or a supplier's invoice notice sits unread in that mailbox, the damage comes from a break in business continuity, not security. A third risk has to do with visibility: accounts left open waste license and plan capacity for nothing, and they skew the lists showing who's actually active. ## What should be prepared before someone leaves? - **Take inventory.** List which services the employee has an account on, and which shared mailboxes and file areas they access. - **Decide who will take over.** Decide in advance who will take on the employee's correspondence and files. - **Ask for a handover note.** Ask them to prepare a short handover note covering open items, pending quotes and key contacts. - **Separate personal account links.** Ask whether the corporate address has been used for personal services; ask that these registrations be moved to the person's own address. ## What steps are taken on the day someone leaves? - **Close or disable the account.** Disable the corporate identity to cut off access to every service tied to it. - **End open sessions.** A session left open on a phone or laptop can keep working for a while even after the password changes; close sessions separately as well. - **Revoke shared-mailbox and file permissions.** The list should cover not just the person's own account, but also the shared addresses and file areas they had access to. - **Keep correspondence running without interruption.** Forward mail arriving at the person's address to the colleague taking over, or assign the mailbox to them; notify contacts of the new point of contact. - **Check devices and shared links.** Collect organizational devices; review any file links the person has shared externally. - **Keep a record.** Keep a written record of which access was closed and when. ## What should happen to a departing employee's emails? Correspondence in a corporate mailbox belongs to the organization, but it may contain personal data. That's why neither deleting the mailbox entirely nor leaving it open indefinitely is right. The mailbox should be disabled, any correspondence needed for business continuity handed over to the person taking over, and how long the mailbox is kept should follow the organization's retention and disposal policy. Handing the departing person's password to the colleague taking over is a common but wrong approach. It makes it impossible to tell who read or sent which email. The right approach is to give the person taking over access under their own account, on the record. ## Which access points are most often forgotten? - Access granted to shared addresses (info@, accounting@). - Permissions on project or department file areas. - A session left open in the mail app on a phone. - Third-party service accounts opened with the corporate address. - File links shared externally. - Shared passwords the person knows; these should be changed immediately. **Tip:** If shared passwords have to be changed when someone leaves, the more lasting fix is to never share these passwords in the first place. When permissions are granted per person, leaving removes only that person's access; no other employee's work is affected. ## Do the same steps apply when someone changes department? Yes, even if the scale is smaller. If an employee moving from sales to accounting keeps access to the sales team's shared mailbox and file area, over time everyone ends up with access to everything. Tying permissions to department reduces this: when a person leaves a department, that department's access is taken from them too. ## Who is responsible for the access-closing process? In small organizations, this task often isn't clearly anyone's full responsibility: HR knows about the departure but can't close accounts, IT can close accounts but finds out about the departure late. As a result, accounts stay open for weeks, sometimes months. The fix is to have a clear owner for the process and a fixed notification rule between the two teams. Once a departure is confirmed, HR notifies whoever manages accounts, in writing, of the departure date and who's taking over. The person managing accounts then runs the checklist and reports back that it's done. These two messages prevent the process from being skipped in most cases. ## What should be done in sudden departures? Not every departure is planned. In departures that end in a dispute, or happen the same day, the order reverses: access is closed first, then the handover happens. The account should be disabled and sessions ended before the person even leaves the meeting; the handover note and transfer of correspondence happen afterward, using the organization's own access. In this situation, the list of shared mailboxes and file areas the person had access to becomes especially important. If the list isn't ready in advance, a missing access point may go unnoticed at the time. That's why keeping the access inventory continuously up to date for every employee, not just at the moment someone leaves, is the safest approach. ## How does DBLinx close access in a single action? - **One identity, one action:** Employees sign in to every product with a single identity (SmartID). When a person is removed from the organization in the organization dashboard, their account is closed in every product they had access to. - **Session closure:** When an administrator closes the account, or the password changes, the person's sessions close on every device. - **Department-tied permissions:** In SmartMail, a person's shared-mailbox access is automatically revoked when they leave a department; in SmartFiles, a person's area permissions are cleared when they leave the organization. - **Mailbox handover:** In SmartMail, a mailbox can be disabled and reopened later if needed; shared mailboxes are assigned to colleagues, as a person or a department, from an assignment board. [DBLinx ecosystem](https://dblinx.net/en/ekosistem)[Remove a person from the organization](https://dblinx.net/en/belgeler/baslarken/kisiyi-kurumdan-cikarma) ## Frequently asked questions Should a departing employee's mailbox be deleted immediately? Usually not. The mailbox is disabled, any necessary correspondence is handed over to the person taking over, and the mailbox is kept for the period set in the organization's retention policy. Is changing the password enough to close off access? It may not be enough on its own. Open sessions also need to be closed, and shared-mailbox and file permissions need to be revoked. What happens to mail sent to the departing person's address? It's forwarded to the colleague taking over, or the mailbox is assigned to them; contacts are notified of the new point of contact. What should happen to a departing employee's files? Work documents sitting in the person's own area or on their computer should be moved to the relevant department's area before they leave. That way documents stay tied to the job rather than the person, and the colleague taking over has access under the same permission structure. Personal documents are handed over to the person and removed from organizational systems. Should access also be closed for an employee on short-term leave? It doesn't need to be closed; but it should be decided who will handle incoming work during their absence, and shared-mailbox assignments should be adjusted temporarily if needed. ## Manage access from one place With DBLinx, people, departments and product access all sit in a single dashboard; a departing employee's access closes in a single action. [Request a quote](https://dblinx.net/en/teklif-iste)[Get in touch](https://dblinx.net/en/iletisim) ## Other guides - [AdministrationWhat is the principle of least privilege? Applying it to email and file access in organizationsThe principle of least privilege means giving each person and each system only the narrowest access needed to do their job, and no more. If an account is compromised or a mistake is made, the damage stays limited to what that account can reach. The principle is applied by granting permission based on job, role and department, and reviewing it regularly.6 min read](https://dblinx.net/en/rehberler/en-az-yetki-ilkesi) - [AdministrationManaging multiple business applications from a single dashboard: people, departments and access in one placeWhen email, files, a website assistant and access control run on separate software, each keeps its own user list, its own permissions and its own invoice. A single dashboard lets you define a person once and grant access to every application from there.3 min read](https://dblinx.net/en/rehberler/is-uygulamalarini-tek-panelden-yonetmek) - [SecurityWhat is CEO fraud? A guide to protecting against fake IBAN emailsCEO fraud is an email scam in which an attacker posing as an executive or supplier convinces an employee to make an urgent payment or pay a fake IBAN. The attacker wants the payment redirected to another account. These emails often carry no malicious link or attachment, so they easily pass through standard spam filters.6 min read](https://dblinx.net/en/rehberler/ceo-dolandiriciligi-sahte-iban)