Quick answer: An employee account security checklist should cover five areas: MFA, passwords, active sessions, access rights and ticket evidence. The goal is not only to make accounts work, but to grant the right access, revoke it on time, detect suspicious forwarding/rules and keep logs for later investigation.
What should an employee account security checklist include?
Businesses should review email, Microsoft 365 or Google Workspace, VPN, NAS/file servers, CRM/ERP, accounting, HRM, internal software and admin accounts. Each account needs an owner, role, MFA, trusted device, data access rule and revocation rule when an employee changes role or leaves.
This checklist belongs in the IT Support and IT Helpdesk workflow, not in scattered personal chat messages.
Why employee account security matters
Many IT incidents start from a user account: weak password, missing MFA, former employee access, suspicious email forwarding, shared accounts without ownership or daily use of admin credentials. Once an account is compromised, an attacker can read email, impersonate staff, download data, change settings or move deeper into the environment.
For small and mid-sized companies, the issue is often process rather than tools. Microsoft 365, Google Workspace, VPN, NAS or accounting software are not enough if access is granted, removed and reviewed inconsistently. Account review should therefore be part of broader business IT system security.
Account groups to prioritize
| Account group | What to check | Risk if missed |
|---|---|---|
| Email/Microsoft 365/Google Workspace | MFA, password, recovery method, forwarding, inbox rules, license | Email loss, data leak, payment or transaction impersonation |
| VPN/Wi-Fi/NAS/file server | Access groups, allowed devices, sessions, shared folders | Access to data outside the role |
| CRM/ERP/accounting/HRM | User role, export permission, approve/edit permission | Operational data errors or data leakage |
| Admin accounts | Separate admin identity, strong MFA, sign-in logs, least privilege | One compromised account can affect the whole system |
| Shared accounts | Who knows the password, last rotation, purpose, replacement plan | No clear accountability |
MFA, password and session checklist
| Item | Action | Implementation note |
|---|---|---|
| MFA | Enable for email, VPN, critical apps and admin accounts | Prefer authenticator app or stronger methods where possible |
| Password | Rotate after risk, employee departure or shared-account exposure | Do not store passwords in unencrypted spreadsheets |
| Sessions | Review signed-in devices and revoke sessions after suspicion | Especially after password change or device loss |
| Rules/forwarding | Check inbox rules, auto-forwarding and mailbox delegates | A common sign of email account compromise |
| Trusted devices | Computer, phone, token, app password and VPN client | Revoke or reset when device ownership changes |
Access checklist across the employee lifecycle
| Scenario | Access rule | What to avoid |
|---|---|---|
| New employee | Grant access by approved role | Do not copy all permissions from a previous employee |
| Role transfer | Remove old rights, grant new rights and keep approval evidence | Avoid permission accumulation over years |
| Leaver | Disable login, revoke sessions, recover devices and transfer data ownership | Follow the HR-confirmed timing |
| Vendor | Limit time, IP/VPN and avoid shared admin use | Disable after the work is complete |
| Emergency account | Keep sealed, log every use | Do not use as a daily admin account |
Review schedule and evidence to keep
| Frequency | Review scope | Owner |
|---|---|---|
| Weekly | New accounts, leavers, suspicious sign-in alerts | IT Helpdesk / IT Support |
| Monthly | Users/licenses, MFA, forwarding rules, delegates, inactive accounts | IT Support plus department managers |
| Quarterly | File/NAS groups, CRM/ERP roles, admin accounts, vendor accounts | IT plus management, accounting or HR when relevant |
| After incident | Revoke sessions, reset password, check rules, logs and user notification | IT Security / IT Support |
| After staff change | Onboarding/offboarding/role-change ticket | HR, direct manager and IT |
Signs that an account may be compromised
Signals that require immediate handling include sign-ins from unusual countries or IPs, unexpected MFA prompts, automatic forwarding to external addresses, unknown inbox rules, bulk email sending, repeated password resets, strange app passwords, unmanaged devices or unusual file downloads.
When these signals appear, do not only change the password. IT should revoke sessions, review MFA, check forwarding/rules, verify devices, review sign-in logs, inspect data permissions and close the case in a ticket. If email is involved, the Microsoft 365 email incident support process gives a structured isolation path.
Do not grant access by copying a previous employee
Many companies grant access to a new employee by copying the previous person. It is fast but risky. The previous person may have accumulated temporary rights, old project permissions or unnecessary access over several years. Access should be granted by current role, current department and current approval.
Role changes need special attention. The account remains active, so old access is often forgotten. Someone moving from accounting to operations, from sales to warehouse management or between branches should be reviewed as a separate ticket.
How to operationalize the checklist in IT Helpdesk
A checklist becomes useful when it is part of a form or ticket. Each access request should include name, department, role, approver, effective date, account groups, data rights, devices, temporary duration and risk notes. A revocation request should include login lock time, data owner, recovered devices and session revocation evidence.
When using an IT Support onboarding/offboarding checklist, account security should be a required section, not an optional note. HR, direct managers and IT can then see the same state.
Reports that make account risk visible
A monthly report should include new accounts, leavers, accounts without MFA, inactive accounts, unused licenses, suspicious forwarding/rules, admin accounts, shared accounts and delayed tickets due to missing approval. Management can act on these numbers more easily than raw technical logs.
For multi-branch companies, split the report by branch or department so management can see where excess permissions, unrecovered devices or unapproved access requests are concentrated.
Practical controls for small and mid-sized businesses
The checklist does not have to become a heavy compliance project. A practical starting point is to protect the highest-risk accounts first: owners, accounting, purchasing, sales leaders, HR, system administrators and anyone who approves payments or exports customer data. These accounts should have MFA, reviewed recovery methods, no unmanaged forwarding and clear device ownership.
Conditional access can then be introduced gradually. For example, block legacy authentication, require MFA outside trusted locations, require approved devices for admin work and alert when users sign in from unusual locations. If the business is not ready for advanced tooling, it can still start with simple monthly evidence: user list, MFA status, admin list, mailbox forwarding list and leaver account status.
How this supports compliance and customer trust
Many customers do not ask for technical logs, but they do expect vendors to control who can access email, files and business systems. A documented account security checklist gives the company a practical answer: access is approved, MFA is enforced for sensitive accounts, leaver accounts are disabled, shared accounts are controlled and evidence is kept in tickets.
This is especially useful for companies that handle quotations, contracts, invoices, personal data, internal drawings or customer support records. When a security question comes from a customer, auditor or partner, IT can show a repeatable process instead of explaining that access is handled informally.
FAQ
Should MFA be enabled for every account?
At minimum, enable MFA for email, VPN, critical apps and all admin accounts. Higher-risk businesses should enable MFA for all users.
Should a leaver account be deleted immediately?
No. Disable login, revoke sessions and transfer data ownership first, then retain or delete data according to company policy.
Should shared accounts be kept?
Minimize them. If unavoidable, define an owner, purpose, strong password, MFA where supported, access log and password rotation schedule.
Read next in the IT Support and account security cluster
Need to review employee account security?
IT Systems helps standardize MFA, access rights, account grant/revoke tickets, email rule checks, license review and monthly risk reporting for businesses.
