How Do I Remove Account Access When an Employee or Contractor Leaves?
By Bill Stilwell · Last reviewed October 17, 2026
The short answer
Section titled “The short answer”Remove access the same day someone leaves or their duties end. Use their row in your access inventory as a checklist: turn off their logins, remove them from your Google Business Profile and other accounts, change any passwords they knew, update recovery details, and collect devices, keys, and codes. Record each step with the date.
What this means
Section titled “What this means”11.7.7 Offboarding access
Section titled “11.7.7 Offboarding access”When a person leaves or changes roles, their access should match their new situation right away. Someone moving from the office to field work no longer needs the bank login.
15.2.6 CRM offboarding
Section titled “15.2.6 CRM offboarding”Turn off the person’s customer relationship management (CRM) login when their duties end. Reassign their open leads and tasks first so nothing falls through.
23.11.2 Access removal
Section titled “23.11.2 Access removal”Remove accounts, permissions, keys, door codes, alarm codes, and device access promptly. This is one step in your full offboarding process (see 23.11 Offboarding Employees).
On GBP, Google says only owners can remove other owners and managers, through Business Profile settings, then People and access. Removed users get an email and lose their admin rights, but replies and posts they made stay on the profile. If the person is the primary owner, they must transfer primary ownership before they can leave. New owners and managers also have to wait 7 days before they can remove other users or transfer primary ownership, so add a trusted second owner well before you need one.
Made-up example: Oak Hollow Landscaping replaces its marketing agency. On the last day, the owner removes the agency from GBP, the website admin, Facebook, and the Google Ads account, changes the shared website password, and confirms the domain registrar email is the owner’s own. She logs each step with the date.
Why it matters
Section titled “Why it matters”- Most people leave on good terms. Some don’t. Either way, open access is a risk.
- Old access gets hacked. An unused account no one watches is an easy target.
- Agencies sometimes keep profiles in their own accounts. Removing access is much harder when they were the only owner.
- Shared passwords stay known until you change them.
Who this applies to
Section titled “Who this applies to”Every business that has ever given anyone else access to anything, including family members, friends who helped, freelancers, and agencies.
How to do it
Section titled “How to do it”- Plan ahead. For planned exits, schedule access removal for the end of the last day.
- Pull the person’s row from your access inventory (see 11.7.5 Access Inventory).
- Turn off their logins in email, CRM, file storage, scheduling, bookkeeping, and the password manager.
- Remove them from GBP, Bing Places, Apple Business Connect, social pages, ad accounts, and the website.
- Change shared passwords they knew, and update any multi-factor authentication tied to their phone (see 11.7.3 Multi-Factor Authentication).
- Fix recovery details that point to their email or phone (see 11.7.4 Account Recovery Methods).
- Forward or keep their business email so customer messages aren’t lost (see 12.1.2 Email Accounts and Shared Inboxes).
- Collect devices, keys, fobs, and cards. Change door and alarm codes.
- Wipe or reset returned devices before giving them to someone else.
- Record each step with the date and who did it.
What proof to keep
Section titled “What proof to keep”- A completed offboarding checklist, dated
- Screenshots of user lists after removal in key systems
- Signed device and key return form
- A note of passwords and codes changed (not the new values)
Common mistakes
Section titled “Common mistakes”- Waiting a week “to be nice.”
- Forgetting free accounts like listings, social pages, and review sites.
- Leaving the agency as owner of GBP after the contract ends.
- Deleting the email account and losing customer messages.
- Not changing the alarm code.
- Discovering the person was the only admin after they’re gone. Keep two admins at all times.
When to get help from a pro
Section titled “When to get help from a pro”Information technology (IT) specialist: for removing access across many systems or recovering accounts a former helper controls. Attorney: if a former employee or agency refuses to hand over business accounts. Questions to ask:
- Can we turn off all of a person’s access from one place?
- How do we get back an account that a former agency created in its own name?
- What should our contracts say about returning accounts and data?
Bill’s note
Section titled “Bill’s note”[Bill: add a short note. For example, a client whose former agency still controlled their Google Business Profile, and what it took to get it back.]
If you’d rather have this done for you, SiteSmarty handles Google Business Profile management.
How I did this for SiteSmarty
Section titled “How I did this for SiteSmarty”- [Date I did this:]
- [What I actually did, step by step: the offboarding access checklist I use for SiteSmarty helpers and vendors]
- [What it cost and how long it took:]
- [What surprised me or what I’d do differently:]
- [Screenshot or photo to add, with private info blurred: a completed offboarding checklist]
- [Result so far:]
Questions people ask
Section titled “Questions people ask”How do I remove someone from my Google Business Profile? As an owner, open Business Profile settings, then People and access, select the person, and remove them. Google says removed users are notified by email.
Should I change passwords when someone leaves? Yes, for any shared login they knew. Better yet, give each person their own login so you can just turn theirs off.
What about contractors and agencies? Same process. Remove access on the day the work ends, and make sure the business owns every account they set up.
What if the person who left was the only admin? You’ll need to go through each platform’s recovery process, which can take a long time. Keep two business-controlled admins to avoid this.
Audit check
Section titled “Audit check”| Line | Question | Pass looks like | Fail looks like | Evidence to collect |
|---|---|---|---|---|
| 11.7.7 Offboarding access | Is access removed the same day someone leaves or changes roles? | Dated checklist completed on the last day | Former staff still active weeks later | Checklist, user lists |
| 15.2.6 CRM offboarding | Are CRM logins turned off when duties end, with records reassigned? | Login off, leads reassigned | Active login for a former worker | CRM user list |
| 23.11.2 Access removal | Are accounts, keys, codes, and devices all removed or collected? | Signed return form, codes changed | Missing keys, old codes still work | Return form, code change log |
Where this fits
Do this first: 11.7.5 Access Inventory, 11.7.6 Least Privilege Access
Do this next: 11.7.8 Emergency Account Access
Related pages: 14.8.2 Owners and Managers, 14.8.3 Transferring Profile Ownership, 11.7.2 Password Manager, 11.7.4 Account Recovery Methods, 12.1.2 Email Accounts and Shared Inboxes
Sources
- Google Business Profile Help, "Manage your Business Profile owners and managers" (checked October 17, 2026)
- Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)
- Cybersecurity and Infrastructure Security Agency, "CISA Releases Cyber Essentials for Small Businesses and Governments" (checked October 17, 2026)
This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.