Someone is leaving
Closing off access and devices on their last day.
Do this on the person's last working day, not a week later. Most access problems come from leavers whose accounts stayed open.
If they used the console
- Go to Settings → Members.
- Remove their account and confirm.
They lose access immediately. Everything they did stays in the audit log — removing the person does not remove the record.
If they were one of only two admins, promote someone else first so you are never left with a single admin.
If they held a device the organisation owns
- Collect the device.
- In Devices, open it and check the last check-in so you know it is really the right one.
- Decide what happens next:
- Going to someone else → Hand a device to someone else.
- Going into a cupboard or out of service → Retire a device.
If the device cannot be collected on the day, select Lock so it cannot be used while you sort it out.
If they used their own device (BYOD)
Select Selective wipe. This removes the work apps and work data and leaves their personal photos, messages, and accounts untouched.
Never use a full Wipe on a device the person owns. It erases their personal life and you will have to explain why.
Check nothing was missed
- In Devices, search for the person's group or any devices you associate with them.
- In the Audit log, search their email address and look at the last few days for anything unexpected.
- Confirm any API tokens they were given have been replaced. Ask an admin.
Write it down
Record the date, the serial numbers, and what you did with each device. If the person later disputes a wipe, or an auditor asks, this record plus the audit log answers it.
