A salesperson who leaves takes their knowledge of your customers with them regardless of what you do. What you control is whether they also keep a working login. Offboarding failures in CRMs are rarely dramatic. They are quiet: an account that stays active for six months, an API token that outlives its owner, a shared login nobody rotated.

Why the CRM is a special case

Departing staff often have more reach in the CRM than anywhere else. They can see the full customer list, export reports, and read the history of every deal. Sales is also the function with the most turnover and the most contractors, which means the offboarding volume is high and the process gets rushed.

The other problem is ownership. Records, open opportunities, scheduled automations and report subscriptions all belong to a user. Deactivating the person without a plan for those things breaks workflows, so teams delay, and the account lingers.

Make HR the trigger

Relying on a manager to remember to file a ticket is fragile. Wire the process to the event that always happens: the HR record changing. Where you use central sign-in, disabling the person in the identity provider should cut CRM access in the same moment. Where you don’t, the HR notification should create a task for the CRM admin with a deadline, ideally the leaver’s last working hour, not the end of the week.

Contractors and agency staff are the group most likely to be missed, because they may not be in the HR system at all. Give every contractor account an end date when it is created.

The order matters

A reliable sequence for a standard departure:

1. Disable sign-in at the identity provider or in the CRM, and end active sessions.
2. Revoke tokens and keys that the person created: personal API tokens, connected-app authorisations, email and calendar sync.
3. Reassign ownership of accounts, open opportunities, cases and scheduled tasks to a named person.
4. Review recent activity for bulk exports or unusual downloads, especially for those leaving on poor terms.
5. Transfer or remove report subscriptions, dashboards and automations that run under the user’s name.
6. Deactivate, then delete later. Most platforms let you deactivate a user while keeping history intact. Delete only when your retention policy allows.
7. Free the licence and record the date.

Step 1 comes first for a reason. Everything else can take a few hours or days. Access should not.

Hunting the hidden access

The user account is the obvious door. The less obvious ones cause the trouble:

• Shared logins. If a team used one login for a tool or a mailbox, the leaver knows the password. Rotate it, and take the opportunity to move to individual accounts.
• Personal API tokens and integrations that run as the user. These can keep working after the account looks disabled, depending on the platform, so check the vendor’s current documentation and test it.
• Forwarding rules and email sync that copy CRM-related mail elsewhere.
• Mobile devices with the CRM app signed in, which may need a remote sign-out or device wipe under your device policy.
• Third-party tools connected to the CRM with the leaver’s credentials.

Handle sensitive departures differently

For a planned, friendly resignation, you might disable access at the end of the last day. For a dismissal or a known conflict, disable access before or at the moment the conversation happens, and review activity from the preceding weeks. Agree this protocol with HR in advance so nobody improvises under pressure.

Offboarding checklist

Step	Owner	Done when
Sign-in disabled, sessions ended	IT / CRM admin	Leaver cannot authenticate
Tokens, keys and app authorisations revoked	CRM admin	No active credentials in the user’s name
Records and tasks reassigned	Sales manager	No orphaned owner on live records
Shared credentials rotated	Account owner	New secret issued to remaining users only
Activity reviewed	Security	Exports and bulk actions checked
Account deactivated, licence freed	CRM admin	Date logged
Devices handled	IT	App access removed or device wiped per policy

A hypothetical example

A regional sales rep resigns and gives two weeks’ notice. On the last day, the admin deactivates the account and reassigns the rep’s opportunities. Three weeks later, a marketing report that fed the weekly pipeline email stops arriving, because it ran under the rep’s user. Worse, a connected spreadsheet tool still pulls contact data using a token the rep created. The team introduces a standard: automations and integrations run under dedicated service accounts, not people; the offboarding checklist includes a search for anything owned by the leaver; and an access review each quarter looks for tokens belonging to inactive users.

Frequently Asked Questions

Should we delete the leaver’s CRM user or just deactivate it? Deactivate in the first instance. It preserves history, ownership trails and audit logs. Delete only when your retention rules allow and you’ve confirmed nothing depends on the user.

What if we need the leaver’s access for a handover? Give the successor access to the records instead. If a short overlap is unavoidable, restrict the leaver’s rights and set a hard end date.

How quickly should access be removed? By the end of the person’s last working period, and immediately for involuntary or sensitive departures. Treat any gap beyond that as a risk to be accepted by someone named.

How do we catch accounts that were missed? Compare active CRM users against the current HR roster and contractor list on a schedule, and flag accounts with no recent sign-in. Quarterly is a reasonable starting rhythm.

Do part-time or seasonal staff follow the same process? Yes. Give them an end date when the account is created and treat the end date like a resignation.

Next Step

Export your list of active CRM users and compare it against the current staff and contractor roster. Any name you can’t match is a deactivation to investigate today.