The order of steps matters. As of October 2026, Microsoft documents that blocking sign-in can take up to 24 hours to take effect. Resetting the password stops sign-in immediately.
Sign out of all sessions comes next and can take up to an hour, as existing access tokens expire. On Google Workspace, a suspended user is still billed at the same rate as an active one, so suspending a former employee and forgetting them keeps paying for a license.
Picture a volunteer coordinator who leaves on a Friday. Her laptop comes back, but her login to the donor database, the shared social media password and the board folder she created all stay open until someone notices. This guide walks through each system in order, with the vendor steps for Microsoft 365 and Google Workspace and a table you can copy into your own process.
What You’ll Learn
- Who is responsible for IT offboarding at a nonprofit, HR or IT?
- How do you remove access when an employee leaves?
- What should a nonprofit IT offboarding checklist include?
- What should you transfer before you delete a former employee’s account?
- Which licenses can you reclaim when someone leaves, and what does an inactive account cost?
- How is volunteer offboarding different from staff offboarding?
- How do you know the offboarding actually worked?
- Frequently Asked Questions
- Your Next Steps
- Sources
Who is responsible for IT offboarding at a nonprofit, HR or IT?
Both, with a clean handoff between them. The trigger comes from whoever manages the relationship: human resources (HR) or the executive director for staff, the volunteer coordinator or program lead for volunteers and interns, and the board chair or secretary for board members. That person sends a notice to whoever runs IT, before or on the last day.
The IT step then needs one named owner and a named backup. Our post on nonprofit data security sets the standard in plain terms: access removed the same day someone leaves, with a named owner for the step. If nobody on staff runs IT, name the outside partner that provides your managed IT services for nonprofits as the owner.
Timing depends on how the person leaves. For a planned departure, schedule the steps for the end of the last day. For an involuntary exit, remove access during or before the conversation. Final pay, exit interviews and benefits belong to HR and sit outside this checklist.
How do you remove access when an employee leaves?
Start with the account that unlocks everything else: Microsoft 365 or Google Workspace. The order matters more than speed, because some controls take effect immediately and others lag by hours.
For Microsoft 365, Microsoft Learn sets out these steps, as of October 2026:
- Reset the password. Microsoft states that this prevents sign-in immediately.
- Select Sign out of all sessions. This can take up to an hour, because existing access tokens last an hour.
- Block sign-in. On its own, this can take up to 24 hours to take effect, which is why it comes third.
Admins working in the Microsoft Entra admin center have an alternative path: clear the Account enabled setting on the user, then select Revoke sessions. Microsoft’s Entra documentation adds one limit. Entra cannot directly revoke a session token issued by an application, so those apps get their own removal step in the checklist below.
For Google Workspace, the Google Workspace Knowledge Center describes suspension as the way to block access while keeping data, as of October 2026. While the user is suspended, collaborators keep access to documents the person shared. Google also notes that Chat sessions can continue until the session ends.
Phones and laptops come next. Microsoft’s offboarding guide includes wiping the former employee’s mobile device. Microsoft’s Entra documentation adds that Intune-managed devices can be reset, and that on an unmanaged device you can wipe the corporate data from managed apps. Collect laptops on the last day and wipe them before anyone else uses them.
What should a nonprofit IT offboarding checklist include?
Every system the person could sign into goes on the list, with a named owner for each row. The table below covers the systems a nonprofit runs on, including the fundraising ones: the donor customer relationship management (CRM) system, donation platforms, social media and shared logins.
| System | What to do on the last day | Transfer or delete? | Who owns it |
|---|---|---|---|
| Microsoft 365 or Google Workspace account | Microsoft 365: reset password, sign out of all sessions, block sign-in. Google Workspace: suspend the user. | Transfer mailbox and files before any deletion | IT owner |
| Admin roles (Global Administrator, super admin, domain registrar, domain name system (DNS), website hosting) | Confirm a second admin exists, then remove the role | N/A | IT owner plus executive director |
| Donor CRM | Remove or deactivate the user | Reassign record ownership and open tasks first | Development lead |
| Finance, payroll and bank portals | Remove the user, update approvers | N/A | Finance lead |
| File sharing (shared drives, OneDrive, “anyone with the link” files) | Remove from shared drives, review links they created | Transfer ownership | IT owner |
| Donation and payment platforms | Remove the user, change shared credentials | N/A | Finance or development lead |
| Social media and email marketing | Remove from page roles, change shared passwords | Move account ownership off personal email where possible | Communications lead |
| Shared passwords and password manager | Remove vault access, change every password they knew | N/A | IT owner |
| Devices (laptop, phone) | Collect, then wipe or run a selective app wipe | N/A | IT owner |
| “Sign in with Google” and “Sign in with Microsoft” apps | Remove the user inside each app | Transfer app ownership if they were the owner | IT owner |
| Licenses | Remove or reassign, then reduce the paid seat count | See the license table below | IT owner |
Admin roles come first. That means the Microsoft 365 Global Administrator role, the Google Workspace super admin role, and the logins for your domain registrar, DNS provider and website hosting. If the person leaving is the only admin on any of these, add a second admin before removing theirs, or nobody is left who can manage the account.
Apps people reach through “Sign in with Google” or “Sign in with Microsoft” need their own step. Some of these apps hold their own session, and that session survives a password reset, which lines up with Microsoft’s note that Entra cannot directly revoke a session token issued by an application. Remove the person inside each app.
Then change every shared password the person knew. Move those credentials into a password manager vault, so the next departure means removing one person’s vault access instead of rotating raw passwords that were passed around by email.
What should you transfer before you delete a former employee’s account?
Deletion is the last step, never the first. Transfer mail, files and records to a colleague while the account still exists, because several of these transfers depend on it.
In Microsoft 365, convert the mailbox to a shared mailbox or set up forwarding, and give a colleague access to the person’s OneDrive, as of October 2026. Microsoft notes the mailbox must still be licensed to convert it. Do not delete the user account while forwarding is in place or while it anchors a shared mailbox.
One detail from Microsoft is easy to miss. If you do not reset the password, the old username and password keep working on the shared mailbox.
In Google Workspace, transfer Drive ownership from the Admin console under Apps > Google Workspace > Drive and Docs > Transfer ownership. Google’s steps have the old owner suspended first and the new owner active. The transfer does not change who has access to the files, and a transfer running longer than 36 hours stops.
Handle Gmail, calendars and Sites before you delete the user. Google documents a 20-day restore window after deletion, and after that window the data is unrecoverable.
Donor CRM, finance and other apps need the same care. Before removing the user from Salesforce Nonprofit Success Pack (NPSP), Bloomerang, Little Green Light, DonorPerfect, Neon CRM or a similar platform, reassign their records and open tasks to the colleague taking over. Each vendor’s help center has the exact clicks for its platform. For the wider set of controls around donor data, see our nonprofit cybersecurity guide.
Which licenses can you reclaim when someone leaves, and what does an inactive account cost?
A former employee’s account keeps costing money until someone removes or reassigns the license. The table below shows what Microsoft and Google document, as of October 2026, with a link to each source.
| Situation | What the vendor documents (as of October 2026) | What it means for cost |
|---|---|---|
| Google Workspace user suspended | Suspended accounts are still charged at the same rate as active accounts on Annual and Flexible plans (Google) | A suspended former employee keeps costing a license |
| Google Workspace user deleted | On Annual/Fixed-Term plans, deleting a user does not reduce your license count or your bill, and the license can be reassigned to someone else; data is unrecoverable after the 20-day restore window; Vault holds stop applying (Google) | Check your plan before assuming deletion saves money, and transfer data first |
| Google Archived User license | Retains data and blocks sign-in; supported on Business Starter, Business Standard, Business Plus, Enterprise Standard, Enterprise Plus and Education editions; price not stated on the page (Google) | A way to keep data without a full license where your edition supports it; check your edition |
| Microsoft 365 mailbox converted to a shared mailbox | The license can be removed if the mailbox is under 50 gigabytes (GB); a shared mailbox up to 100 GB needs an Exchange Online Plan 2 license assigned; keep the user account (Microsoft) | Frees a license while keeping mail accessible |
| Microsoft 365 license removed | All holds must be removed before the license is removed; user data is held 30 days, then permanently deleted (except SharePoint documents); reduce paid seats under Billing > Your products (Microsoft) | Frees the license; reduce the seat count or it keeps billing. For a user whose mail you must keep, follow the retention row below instead |
| Microsoft 365 retention before deletion | A hold or retention policy must be applied before the account is deleted to keep the mailbox as an inactive mailbox (Microsoft); a hold needs Exchange Online Plan 2, or Plan 1 plus Exchange Online Archiving (Microsoft) | Check your plan if records or grant rules require keeping mail. Order: apply the hold, then delete the account with the hold still in place; do not remove the license first, because that requires removing the holds |
Retention needs attention before deletion, not after. In Microsoft 365, a hold or retention policy must be in place before you delete the account; without one, the mailbox data is gone after 30 days. In Google Workspace, deleting a user ends Vault holds and retention for that user, and a user on litigation hold cannot be deleted until the hold is lifted. This matters when grant audits or records retention rules apply to your organization.
Check your edition before planning around any of this. Google lists the Archived User license for the editions in the table above, so confirm whether your Google Workspace for Nonprofits account offers it and whether it includes Vault. On the Microsoft side, confirm whether your nonprofit plan includes Exchange Online Plan 2, or Plan 1 plus Exchange Online Archiving, before counting on a hold.
How is volunteer offboarding different from staff offboarding?
Volunteers and interns who work from personal email, personal devices and shared logins leave no Microsoft 365 or Google Workspace account to suspend. For them, the checklist shifts to removing them from shared drives, the donor CRM and group accounts, and changing any shared password they knew.
The harder problem is volunteer drift. People who stop showing up never formally leave, so no notice ever reaches IT. Set a review rhythm instead, for example at the end of each program cycle or season, and compare who still has access against who is still active.
Seasonal staff and event volunteers arrive and leave in waves. Batch the review at the end of each wave rather than handling each person one at a time.
Board members are the easiest group to plan for, because fixed terms set the end date in advance. Schedule removal from the board portal, shared board folders and any board email account for the day a term ends. Our post on IT consulting for education and youth nonprofits covers a mentor and volunteer coordinator example.
How do you know the offboarding actually worked?
Check each system on the checklist after the steps run. Confirm that sign-in is blocked, sessions are revoked and the person no longer appears with active access anywhere on the list. Record the date and who did each step.
To catch anyone the process missed, compare your roster against active accounts. Our nonprofit data security post explains that check.
Any working login can be turned against you. In our phishing attack prevention case study, more than 2,000 phishing attacks were blocked in the year before March 2026 with zero credentials compromised, and two separate attacks came from compromised Microsoft 365 accounts belonging to people still working at partner organizations. A former employee’s account that still works is the same kind of opening, with nobody watching it. If no one on your team has the time to own offboarding, outsourced IT services for nonprofits give the step a named owner and a backup.
Frequently Asked Questions
How long should IT offboarding take?
Access removal should happen the same day the person leaves, with one named owner for the step. Start with the account-level steps, keeping in mind that Microsoft documents Sign out of all sessions as taking up to an hour and Block sign-in as taking up to 24 hours, as of October 2026. Transferring mail, files and records takes longer, and that work continues after access is closed because the account stays in place until the transfer is done.
What should I do with a departing employee’s email?
Convert the mailbox to a shared mailbox so a colleague can read and answer incoming mail, or set up forwarding. Microsoft requires the mailbox to still be licensed at the time of conversion, and the user account has to stay in place while forwarding is active or while it anchors a shared mailbox. Reset the password first, because otherwise the old username and password keep working on the shared mailbox.
How much does nonprofit employee offboarding cost?
No reliable nonprofit-specific figure exists for the cost of offboarding. The cost you can measure is license fees for former users: Google bills a suspended account at the same rate as an active one on Annual and Flexible plans, and Microsoft 365 keeps billing for a seat until you reduce the seat count. The cost you cannot price in advance is the exposure of an account that still works after its owner has gone.
What is a zombie account and why is it dangerous?
A zombie account is a login that still works after the person it belongs to has left, or after a volunteer has drifted away. Nobody watches its activity, so a stolen or reused password goes unnoticed while the account still reaches email, files and the donor CRM. During the Scottship 10-day Tech Stack Audit, we look for leftover accounts like these as part of reviewing security gaps.
Do I need to track IT offboarding for compliance?
Yes. Keep a record of who removed which access and when, for every system on the checklist. If grant agreements or records retention rules require you to keep email or files, in Microsoft 365 apply a hold or retention policy before deleting the account, so the mailbox is kept as an inactive mailbox where your plan supports it. In Google Workspace, deleting a user ends Vault holds and the data can be purged, so do not delete the account; assign an Archived User license instead, after checking that your edition offers it.
Your Next Steps
- Name the owner: Pick one person to own IT offboarding and one backup, and tell HR, the volunteer coordinator and the board chair who to notify.
- Copy the table: Add the checklist table above to your own process document and fill in the “Who owns it” column with real names.
- Add a second admin: Confirm every admin account (Microsoft 365, Google Workspace, domain registrar, DNS, hosting) has at least two people with access.
- Check your licenses: Look for suspended or unused accounts still billing in Microsoft 365 or Google Workspace, and reduce your seat count.
- Set a review date: Put an access review on the calendar for the end of your next program cycle or season.
At Scottship Solutions, we help nonprofits find the accounts, licenses and admin roles that outlast the people who used them. If you are not sure who still has access, our 10-day tech stack audit can give you a clear picture.
Sources
- Microsoft Learn, Remove a former employee from Microsoft 365: overview of the offboarding steps, including wiping the former employee’s mobile device and giving a colleague access to their OneDrive (Step 5) (as of October 2026)
- Microsoft Learn, Step 1: resetting the password prevents sign-in immediately; Sign out of all sessions can take up to an hour; Block sign-in can take up to 24 hours (as of October 2026)
- Microsoft Learn, Revoke user access in Microsoft Entra ID: Account enabled and Revoke sessions; Entra can’t directly revoke a session token issued by an application; Intune-managed devices can be reset and corporate data wiped from managed apps on unmanaged devices (as of October 2026)
- Microsoft Learn, Convert a user mailbox to a shared mailbox: mailbox must be licensed to convert; 50 GB limit without a license (100 GB with Exchange Online Plan 2); old credentials keep working unless the password is reset (as of October 2026)
- Microsoft Learn, Step 4: forwarding a former employee’s email; keep the user account while forwarding is in place (as of October 2026)
- Microsoft Learn, Step 6: all holds removed before license removal; Exchange Online plan needed for a hold; user data held 30 days after license removal; reducing paid seats under Billing > Your products (as of October 2026)
- Microsoft Learn, Inactive mailboxes: hold or retention policy required before deletion (as of October 2026)
- Google Workspace Knowledge Center, Suspend a user: suspended users billed at the same rate as active users; data kept; Chat sessions continue until the session ends (as of October 2026)
- Google Workspace Knowledge Center, Delete a user: 20-day restore window; on Annual/Fixed-Term plans, license count and bill unchanged and the license can be reassigned; Vault holds stop applying; users on litigation hold cannot be deleted until the hold is lifted (as of October 2026)
- Google Workspace Knowledge Center, Transfer Drive files to a new owner: Admin console path; access unchanged by transfer; transfers stop after 36 hours (as of October 2026)
- Google Workspace Knowledge Center, Archive former employee accounts: Archived User license and supported editions (as of October 2026)
- Google Workspace Knowledge Center, Preserve data for users who leave: deleting a user ends Vault holds and retention (as of October 2026)
Written by
Will Facques
Senior IT Consultant at Scottship Solutions
Will works directly with nonprofit and small business clients on infrastructure, managed services, and technology implementations. He translates complex technical requirements into practical solutions that actually get done.
Certifications
PMP (Project Management Professional) • Lean Six Sigma Yellow Belt • CompTIA Network+
Industries Served
Human Services, Healthcare & Community Health, Education & Youth Development, Faith-Based, Child Advocacy, Arts & Culture