Treat a departure as an access and records event
When an employee leaves a business, the company must address more than the mailbox password. The departing person may control a personal work mailbox, a shared enquiries address, administrative access to the domain or hosting, devices with cached customer messages, and automated forwarding rules. Those connections can affect ongoing orders and the confidentiality of records long after their last working day. An offboarding plan should begin with authorised business ownership and required retention, not with an immediate deletion of every account associated with the person's name.
Define the departure date, responsible manager, legal or contractual preservation needs, and the person who will receive unfinished work. Confirm the employee's current role and systems from an access inventory rather than relying only on a supervisor's memory. If the person handled customer payments or domain administration, additional controls may be urgent. Avoid collecting private correspondence without authority: business records, employee privacy and local employment obligations must be considered with qualified advice where applicable. The goal is continuity with appropriate access.
Identify every mailbox and role address involved
List named mailboxes such as amin@company.example, public addresses such as accounts@ and sales@, aliases, shared-mailbox memberships, forwarding destinations and any app-specific sending accounts. The departed employee might not own all the mailboxes they could access, and a public alias may depend on their individual account. Check the email host and any separate productivity platform because the company might use more than one. A website contact form could deliver notifications to an address managed by the person leaving, even if other staff never noticed that dependency.
Make a controlled spreadsheet or ticket with the address, business purpose, present administrator, permitted delegates, last required access, retention decision and replacement owner. Use only verified company accounts. An old shared password or unofficial Gmail forward could bypass normal administrative controls, so search for approved and unexpected forwarding destinations. Do not assume the mere existence of an alias in DNS proves where messages go; inspect the actual mail platform. This inventory prevents accidental interruption when the individual login is disabled.
Separate access revocation from mailbox deletion
Disabling sign-in can stop future account use while preserving data that the organisation lawfully needs. Deleting an account or mailbox can trigger irreversible data loss or a platform-specific recovery window, and the exact behaviour differs by service. The first question is whether the departing person's access should end, not whether the stored correspondence should be destroyed. Coordinate the timeline with human resources or management, especially in planned resignations, remote terminations or suspected account compromise.
For a basic cPanel mailbox, the host may offer password changes or administrative account removal, but the documented workflow and data retention depend on service configuration. For Microsoft 365, the official former-employee process includes blocking sign-in, preserving appropriate email and files, removing or changing access, and only then handling account licensing or deletion. Follow current provider instructions and approved company policy. Do not copy a procedure for one vendor into a different control panel without verifying its effects.
Preserve valid business records before altering accounts
Past quotations, accepted orders, project change requests, payment confirmations and support conversations may be important to the organisation. Identify which categories must remain available and who is authorised to access them. Retention may depend on contracts, regulations, privacy law or litigation obligations; there is no universal rule that every message from a former employee should be kept forever. Ask the responsible business owner to state the legitimate purpose and duration. Separate unrelated personal material wherever lawful and technically possible.
Where the platform supports export or backup, secure the necessary records and test that a representative message and attachment can be recovered. An IMAP synchronisation alone can propagate deletion and should not automatically be treated as an independent archive. Record the date of preservation, access rights, format and future disposal review. If there are unresolved disputes or legal holds, do not apply generic deletion settings before the competent person has reviewed them. An employee's old inbox is not a substitute for a documented records system.
Understand Microsoft 365 shared-mailbox conversion correctly
Microsoft's current administration guidance permits conversion of an eligible user mailbox into a shared mailbox, retaining existing email and calendar information. It is not the same as simply renaming a departed person's account. The original account remains an anchor and should not be deleted casually. Conversion and subsequent licence changes must follow documented conditions, including size and feature-dependent licensing rules. A staff member's credentials also need to be blocked or changed so the old account cannot be used to access the preserved mail.
Microsoft states that a licence must be assigned before certain conversions, and that common unlicensed shared-mailbox operation has storage restrictions; enhanced features may need separate licences. Do not present this as a universal zero-cost archive. Delegated staff require their own approved accounts and the right permissions. The business should test read and send behaviour from the new manager's identity and confirm that sensitive folders are not exposed to too broad a group. Follow the latest Microsoft documentation for the exact tenant configuration.
Handle a cPanel account without relying on shared passwords
A small business using cPanel email may have an individual mailbox that also receives public requests through forwarders. Before removing the person's login, inspect the Email Accounts and Forwarders interfaces or provider-equivalent administration tools. If enquiries@ forwards into the departing person's named mailbox, changing only the password may leave new customer messages arriving at an account no one monitors. Reassign approved routing, test it, and determine whether an independent role mailbox or a new forwarder should replace the arrangement.
cPanel documentation explains that forwarding from an existing mailbox can result in both the original mailbox and the target receiving copies. Therefore a forwarded public address may still preserve data on the old account. Do not delete that mailbox without considering the messages and any required backup. Use the provider's supported account-management actions; sharing the former employee's password with the replacement is not a controlled transfer. Check provider support if the interface is disabled or the account is part of a hosting bundle.
Reassign open customer conversations, not only incoming routing
A redirected address can receive new messages, but staff still need to know which older conversations require action. Create a list of outstanding quotations, promised follow-ups, unresolved complaints and supplier requests that are within the employee's role. Assign each to a named current employee, recording deadlines and necessary context without unnecessarily exposing unrelated private content. Customers may continue replying to old threads directed to the former employee's named address, so decide whether an approved temporary routing or notice is appropriate.
Where lawful and consistent with policy, an appropriately worded automatic response can direct new enquiries to a monitored company address, but do not imply the departed employee still works there. Test how replies behave and watch for sensitive documents arriving at the old address. A shared-mailbox or support-system handover can help preserve conversation continuity if supported. Do not forward every piece of correspondence automatically to an unrelated employee without checking confidentiality and data-minimisation requirements.
Review all devices and persistent sessions
Employees may access mail from company laptops, personal phones, tablets, web browsers or third-party applications. A password change may not immediately revoke every cached session or locally stored message. Some services provide session invalidation, device management or account-token revocation; other basic hosting environments have fewer controls. Determine what the actual platform supports before claiming remote account removal guarantees that the former worker's device contains no copies.
Collect company-owned equipment according to company procedure, revoke approved application access, and review mobile mail profiles or delegated permissions. For personal devices, use legally appropriate policy and the provider's supported account removal features. Record which actions were completed and which cannot be verified. Do not assume that removing an account on the server erases attachments already downloaded to a computer. A realistic offboarding plan combines technical revocation, equipment return and confidentiality obligations.
Rotate privileged access to domain, DNS and hosting
Sometimes the person leaving was the only employee who could log into the domain registrar, DNS dashboard, website hosting or email administration. Those privileges are separate from their mailbox and may control all company communications. Verify that the business owns the accounts and has authorised administrators before the employee's departure. Update recovery details, remove unnecessary delegated users and review security logs where available. Avoid changing records unnecessarily while reassigning control.
Do not reset MX, nameservers or SPF merely because the prior administrator has left; those settings should remain stable unless a documented change requires them. Instead, remove their administrative access through the relevant provider and confirm another authorised person can sign in safely. If the hosting account was registered using their personal address, investigate the provider's identity-verification and ownership transfer procedure rather than guessing or creating duplicate accounts. Protect mail service continuity while correcting governance.
Check aliases and forwarding for unintended data exposure
A forwarding rule can silently copy or redirect messages outside the organisation. Review public role addresses, each named mailbox's automatic forwarding, client-side rules and any separate distribution services. A malicious or simply forgotten rule may continue sending invoices or customer details to an old personal destination. Compare destinations with the approved address inventory and revoke those no longer needed. Use cPanel's Forwarders Trace feature where available to inspect the documented route.
Changes to forwarding should be tested from an external sender. Confirm that the correct replacement receives the message, that a reply uses the approved address, and that copies are not still arriving at a former employee's account unnecessarily. Forwarding may interact with spam filtering, so watch for rejected or delayed messages rather than relying on the settings screen alone. Record the results and consider the confidentiality of already forwarded historical messages separately.
Use a controlled timeline for planned departures
In a planned resignation, the business can prepare an orderly sequence: inventory access and current work, preserve required records, arrange a replacement, confirm account recovery, schedule revocation for the authorised date, then test customer channels and monitor for exceptions. This is an illustrative process, not a rigid legal timetable. If the departure is disputed or involves suspected abuse, legal, HR and security considerations may require a different sequence and quicker access containment.
Assign a named coordinator so domain administrators, managers and mail-host support do not make overlapping changes. Share only the minimum necessary details with colleagues. Prepare an escalation route if a critical invoice or customer message cannot be located after the transfer. If there is no complete inventory, begin with the most consequential systems such as public business email and domain control. The goal is to reduce uncertainty without inventing guarantees that every personal device can be remotely cleared.
Test business continuity after access changes
Once sign-in or forwarding has been changed, send controlled external test messages to important role addresses and, when policy permits, to the former employee's named work address. Check whether the new responsible employee receives them and can reply using an approved company identity. Verify the availability of required historical conversations, particularly open customer cases and finance records. Confirm that the former worker no longer appears among authorised delegates or administrators where that can be inspected.
An offboarding checklist should distinguish what has been completed from what remains uncertain. For example, the team may verify account sign-in has been blocked but not prove that a personal device's existing offline cache has been erased. Document these limits and apply policy or legal measures where appropriate. A single successful email test is not proof all devices and forwarding paths are secure. Follow up after a normal business period to catch requests that continue to arrive through older contacts.
Handle licence and renewal decisions after preservation
Terminating a user subscription immediately may appear to save a small amount, but some services change the retention or accessibility of mailbox contents when licensing or accounts are removed. Microsoft 365 shared-mailbox conversion and its licence conditions require an ordered procedure; basic hosting providers may have other cancellation or deletion rules. Decide whether records need to remain online, be exported or be disposed of lawfully before editing billing. Do not assume a grace period without checking the supplier's current terms.
Update the organisation's licence inventory only after required access and data decisions have been completed. Record ongoing ownership of a role mailbox, renewal contact and the manager who authorises future changes. Do not leave unused licensed users indefinitely without a business reason or formal record retention requirement. A good handover identifies where files and messages remain, who can access them and how they can be recovered if an authorised request arises.
Complete the handover with evidence and clear limits
The business should be able to answer five questions: who controls the domain and email administration; who now handles old and new customer enquiries; which records were lawfully preserved; which access rights were revoked; and which exceptions need further action. Record dates, responsible people and the provider-specific procedures used. Make a separate note when legal or privacy review is required. Do not publish confidential details about a former employee on a public website or in a general company newsletter.
For a Malaysian SME seeking OnHypp support, describe which mail service is in use, the list of business-controlled addresses, required retention, current account ownership and the proposed receiving employee. A scope-matched review can then identify whether the work involves a cPanel mailbox, a Microsoft shared mailbox, domain access, or several systems. The correct result is continuity and appropriate control; it is not automatically deleting every old account or allowing staff to reuse a former employee's credentials.
Sources & further reading
Ready to explore a related service?
See the related OnHypp service and decide whether it fits your business needs.
Email & hostingDomains