By the time an employee hands in their notice, the decisions that will make their departure clean or messy have already been made.

They were made in the first weeks of the person’s tenure — when nobody was paying close attention because the new hire had just arrived and there were a hundred other things to do. A shared login here. A quick SaaS sign-up there. A personal laptop used “just until the company hardware arrives.”

By month six, none of those feel like decisions. They feel like how things are.

This post covers what’s really going wrong when offboarding takes three weeks, the four onboarding shortcuts that guarantee a painful exit, how to retrofit hygiene on the team you already have, and what your IT provider should be doing at onboarding that probably isn’t happening yet.

For businesses across Laurel, Hattiesburg, and the wider Pine Belt — where teams are lean and people wear multiple hats — getting the joiner side right is the difference between an hour of cleanup and three weeks of excavation.

What’s really going wrong when offboarding takes three weeks

A clean offboarding takes about 90 minutes of IT time:

  • Disable the account in your identity provider (cascading SSO revocation)
  • Remotely wipe or collect and wipe the device
  • Forward email to a manager or convert to a shared mailbox
  • Reassign CRM and project-tool ownership
  • File a handover note that was already templated at onboarding

The messy version of the same process can take three weeks. It starts with a manual list of tools nobody can fully remember — which usually means asking the departing employee to help reconstruct it. You find a Figma account, a Loom workspace, a Notion instance, and an Airtable base, all set up independently, all with passwords sitting in a personal password manager. The laptop is at their house. A client gets a strange message from a personal address. Six weeks later, a vendor still charges the company card for a seat you thought you cancelled.

Whether offboarding is clean or chaotic depends on what was set up during onboarding.

In identity management, this is the joiner, mover, leaver lifecycle. A rushed joiner phase compresses months of identity cleanup into the two weeks after the resignation lands.

Four onboarding shortcuts that guarantee a painful exit

1. Letting new hires sign up for SaaS tools on their own

When someone signs up for a tool with their work email and a password only they know, that account is functionally theirs. You can’t reset it without notifying them. You may not even know it exists until an invoice appears — or until the account goes dark after they leave and a client project breaks.

This is the most common source of “we can’t find half the logins when someone leaves.”

Fix: Provision tools through a central identity system. Connect new SaaS apps to single sign-on before the first user logs in.

2. Tolerating personal devices “just until we get them sorted”

Personal devices that get used for work don’t stay temporary. Apps get installed, client systems get connected, files get downloaded — and the temporary fix becomes permanent. When they leave, you have no ability to wipe company data from a device you don’t own and never enrolled in management. You’re relying on goodwill. That’s usually fine. It is not a security control.

Fix: Issue company-owned devices on day one and enroll them in mobile device management. If you allow a personal device, require managed app access for company email and files.

3. Shared logins for tools you didn’t want to pay per-seat for

Shared credentials are the worst offender at offboarding. When five people use the same login, you can’t remove one person’s access without changing the password for everyone. You usually find this out at the worst time — when the person leaving set up the account and nobody else remembers the password.

Per-seat is the cost of doing this properly. The “savings” from shared logins reappear during offboarding as wasted hours and exposed access.

4. Letting client relationships live in one person’s inbox

This one hits agencies and professional services hard — CPAs, law firms, consultants, and account managers common across Mississippi. When a senior person leaves, client context, email history, preferences, and half-finished threads often leave with them.

From the client’s side, your business suddenly doesn’t know who they are.

Fix: Use a shared inbox or CRM where client communication is logged. Even a Microsoft 365 shared mailbox with a clear expectation that client threads are CC’d is a meaningful improvement over what most small businesses have today.

How to retrofit hygiene on the team you already have

You can’t go back and re-onboard everyone. You can audit what’s there and close gaps before the next departure.

The SaaS audit

Pull three months of credit card statements (every card used for business expenses) and list every recurring SaaS charge. For each one, note who set it up, who has the login, whether it uses a personal or company email, and whether anyone else could access it if that person left tomorrow.

You’ll find tools nobody remembers, tools with no backup access, and seats you’re still paying for after someone already left. This is a spreadsheet and an afternoon — not a technical project.

The device register

Build a simple list: who has what, when each device was issued, whether it’s enrolled in management, and what company data it can access. Ask every staff member to confirm devices used for work, including personal ones. Frame it as mapping, not punishment.

For any personal device with company access, the minimum is managed apps that can be remotely disconnected.

Client communication in shared places

Move client communication into shared places so the relationship belongs to the business. Set up shared mailboxes or aliases for client-facing work, and use a CRM for contact history. Start with the highest-risk accounts first.

What your IT provider should be doing at onboarding

Most IT providers get called when someone resigns. They disable the account, collect the laptop if they can find it, and do their best with whatever documentation exists. That’s the wrong end of the lifecycle.

The model that works puts IT at onboarding too:

  • Create the account in your identity provider
  • Enroll the device in mobile device management
  • Provision access through SSO so every tool ties to a central identity that can be switched off in one action
  • Maintain a handover document listing systems, client relationships, and credentials tied to that person

When that’s in place, offboarding becomes a checklist and an hour — not a three-week dig.

At West Computers, we treat joiners and leavers as one lifecycle: identity, device enrollment, and access that can be revoked cleanly when someone moves on.

A 60-day plan before your next round of departures

You don’t need to know the exact resignation date to start.

Weeks 1–2: Run the credit card SaaS audit. Flag any login only one person controls.

Weeks 3–4: Build the device register. Enroll company devices; add managed app access for personal devices with company data.

Weeks 5–6: Audit client-facing communication. Set up shared mailboxes or CRM logging for the highest-risk relationships.

Weeks 7–8: Write the onboarding process you wish you’d had. Apply it to the next hire — and use it as the template for handover docs for existing staff.

Most of this is operational: a spreadsheet, honest conversations with your team, and a few hours of IT support.

Frequently asked questions

How long should offboarding take in a small business?
With proper onboarding hygiene and centralized identity, the IT side takes about 60–90 minutes. Without that foundation, the same task can stretch to two or three weeks.

How do I find SaaS tools my team signed up for without telling me?
Review three months of every credit card statement used for business expenses. Most shadow SaaS shows up as a recurring charge.

Can I wipe a personal device after someone leaves?
Only company data — and only if you set that up while they were employed. MDM or managed app access lets you remove email, files, and credentials without touching personal content. Without those tools in place earlier, options are limited.

What’s the role of single sign-on in offboarding?
SSO ties every tool to a central identity. Disabling that identity revokes access everywhere. Without SSO, you manually remove the user from each platform.

Should employees use only company devices?
Where practical, yes. For personal devices, managed enrollment or managed app access is the next best thing. A personal device with saved company credentials and no management is the highest-risk offboarding configuration.

Article adapted with permission from The Technology Press.