Start with an account and contact-point inventory
Use this checklist when a team member is leaving or changing responsibilities. The aim is to make sure the business can manage its accounts through legitimate, documented access—not to conceal who uses them or bypass a platform’s checks. Treat each account as a working tool used under the relevant platform’s terms. Some platforms may not permit an account to be transferred or used by a different person or business; check the applicable rules before changing ownership or access.
Begin with an inventory of the accounts the person helped create, administer or recover. Include advertising, analytics, publishing and other business accounts where applicable. For each one, record:
- The platform and account name or business purpose.
- The person or team that should be responsible after the departure.
- The mailbox used for sign-in, notices or recovery.
- The phone number used for recovery or verification.
- The second-step method, such as an authenticator app, security key or text message.
- Any backup or recovery method the platform provides.
- The people and roles with access.
- The person responsible for making and checking each change.
Do not assume that an account is under business control just because its name refers to the business or its work was paid for by the business. Check the actual sign-in and recovery details in the platform’s official settings. Keep the inventory in a restricted business record, not in a shared document containing passwords or active recovery codes.
Agree on a transparent handover
Tell the departing team member which accounts are in scope and what needs to change. Coordinate the handover openly, while the person still has authorized access where possible. Confirm who in the business is permitted to make each change and who will take responsibility for ongoing administration.
Keep personal and business information separate. A team member should not be asked to hand over a personal mailbox, personal phone number, private authenticator account or personal credentials. If a business account depends on one of these, use the platform’s official settings or support process to add an authorized business contact or recovery method. If the platform does not allow the requested change, follow its guidance rather than trying to work around the restriction.
Agree on a safe sequence: establish an appropriate business-controlled recovery method, check that it works through the platform’s normal process, and then remove the departing person’s access where authorized. Avoid exchanging passwords in chat or email. Do not ask anyone to share a one-time code, backup code or private sign-in details. The departing person can complete a change while signed in, or an authorized administrator can use the platform’s supported role and recovery controls.
Move mailbox access into business control
For a mailbox used by an account, first determine whether it is a business mailbox or a person’s private mailbox. If it is personal, do not take over the mailbox itself. Instead, check whether the platform allows the account’s contact or recovery email to be changed to an address the business controls. Make that change through the account’s own settings, using an authorized administrator or the departing person as appropriate.
Before changing the address, confirm that the replacement mailbox is active, accessible to the responsible business team and protected by the business’s normal security practices. Then follow the platform’s official confirmation process. Check the mailbox for the platform’s notice or verification message, and verify the updated address by returning to the account settings. Do not rely only on an email saying a change was made; confirm the current details inside the account.
If the account uses an address on a business domain, make sure the business can administer that mailbox independently of the departing person. Review mailbox delegates, forwarding rules and recovery methods through the organization’s approved mail administration tools. Remove access that is no longer needed, but preserve business records according to the organization’s retention practices. Do not redirect a former employee’s private messages or use mailbox access to impersonate them.
Review phone numbers and second-step methods
A phone number can be a recovery contact, a verification method or both. Check each account’s settings to understand how it is being used. If the number belongs to the departing person, do not continue relying on it as the business’s recovery route. Ask the platform what supported options are available, and use only numbers and methods the business is authorized to control.
Where a business-controlled number is appropriate and permitted, add it through the platform’s official settings and complete any required verification. Confirm that the number is maintained by the business and that access is available to the people responsible for account security. A shared or managed number should not be used in a way that misrepresents the identity of the person operating the account.
Review other second-step methods as well. An authenticator app or security key may be tied to the departing person rather than the business. Add an authorized replacement method through the platform’s settings before removing the old one, where the platform permits that sequence. Store any recovery material only in an approved, access-controlled business system. Never copy codes into the account register, send them to a group chat or keep them in an unprotected file.
Change recovery details through each platform
Make changes separately in every relevant platform. A mailbox or number update in one service does not automatically change the recovery details on another. Sign in only through the platform’s official route and use its current account, security and recovery settings. The names and locations of controls can differ, so follow the platform’s own help instructions rather than relying on an assumed menu path.
For each account, check the displayed email address, phone number, second-step methods and recovery options. Update only what the business is authorized to manage and what the platform permits. Complete confirmation steps using the intended business-controlled contact method. If a platform requires the current owner or administrator to approve a change, coordinate that approval openly.
If a change is unavailable, blocked or unclear, pause and use the platform’s official support or appeal channel. Explain the ownership and access situation accurately and provide only information requested through the official process. Do not create another account to get around a restriction, misstate who owns or operates an account, hide connections between accounts, or use borrowed or false identity details. A platform’s review or verification process is part of using the service, not an obstacle to evade.
Remove the departing person’s roles and sessions
Once the business has confirmed that the account’s recovery route is appropriate and working, review all assigned roles. Remove the departing person’s access through the platform’s own user, team or permissions settings, following the organization’s authorization process. Check for direct access as well as access through a shared team, agency or administrative group.
Look for other access paths the person no longer needs, such as connected apps, integrations, delegated mailbox access or active sessions, where the platform provides controls for them. Revoke only access that the business is authorized to revoke and that is no longer required. Avoid changing someone else’s personal account or device settings. If the platform provides a supported option to end sessions or review connected services, use its guidance and record the action.
Do not remove the departing person before the handover is ready if doing so would leave the business unable to make an authorized change or respond to a legitimate security check. Conversely, do not leave unnecessary access in place simply for convenience. Coordinate the timing with the responsible administrator, confirm the handover is complete, and make the access change promptly under the organization’s policy.
Verify the handover and update the register
After the settings changes, have the responsible business administrator verify the account using the platform’s ordinary sign-in and recovery checks. Confirm that the business-controlled mailbox can receive relevant notices, that the approved second-step method is available, and that the departing person’s role no longer appears where it should have been removed. Do not test access by attempting to enter the departing person’s personal mailbox or device.
Update the account register with the new business contact details, responsible role, access status and handover notes. Record what was changed, who completed it and whether any platform-specific issue remains. Keep the record factual and limited to what the business needs. Do not include passwords, one-time codes, backup codes or sensitive personal information.
If a platform has not accepted a change or the account still depends on a personal contact method, mark that as unresolved and assign it to an authorized owner for follow-up through official support. Do not label the account fully handed over until the business has verified the access it is meant to control. Current requirements and available recovery options are published on each platform’s own help and policy pages.
Make the checklist part of routine account management
A departure is a useful prompt to correct weaknesses that may have existed for a long time. Keep an up-to-date register of business accounts, recovery contacts, second-step methods and authorized roles. Review it when responsibilities change, when an account is created or acquired, and during the organization’s normal access reviews. Restrict the register to people who need it for account administration.
For future account setup, use business-controlled contact methods where the platform permits them, and assign administration to appropriate business roles rather than relying on one person’s private details. Make responsibilities clear in internal procedures and, where relevant, in written agreements. These practices reduce confusion during a handover but do not override a platform’s rules about account ownership, eligibility or who may use an account.
The standard is straightforward: make changes openly, use the platform’s official settings and support channels, protect personal information, and document what the business can actually verify. If the platform does not permit a particular transfer or change, respect that limitation and seek its official guidance instead of attempting to bypass it.