Managing user accounts is something I have done at large scale, and the same principles work for a business of three people. The goal is simple: people get what they need on their first day, and lose access on their last day, with no company information walking out the door.
Before you start: keep a list
Keep one simple list of every tool your business uses (email, file storage, accounting, scheduling, social media, and so on) and who has access to each. This list makes both onboarding and offboarding much faster.
Onboarding a new person
- Create a personal company account for them, such as their own company email address.
- Give only the access they need for their role. This is called least access. You can always add more later.
- Add them to shared calendars, folders and groups rather than sharing individual files one by one.
- Turn on two-step verification for their account from day one.
- Set up their devices, or if they use their own phone, decide what company apps and data are allowed on it. Mobile device management (MDM) tools can help here.
- Show them where things live and how to ask for help. A short written guide saves many questions.
- Update your access list.
Shared accounts versus personal accounts
- Give each person their own login wherever possible, so you know who did what and can remove one person without affecting others.
- If a tool only allows one shared login, store it in a business password manager with sharing, not in a note or email.
- When someone who knew a shared password leaves, change it.
Offboarding on the last day
- Turn off or suspend their accounts at the end of their last day, not weeks later.
- Remove them from shared password vaults and change any shared passwords they knew.
- Transfer ownership of their files, documents and calendars to someone who is staying.
- Set up email forwarding or an auto-reply so customer messages are not lost.
- Collect company devices, and remove company data from personal devices.
- Update your access list.
Recover company data first
Before deleting any account, make sure the files and email inside it are saved or transferred. Some services delete data permanently soon after an account is removed.
Want help setting up a clean process for your team? Talk about contract work.