Teams and business

Offboard a team member

Learn how to keep your company’s 1Password data safe when someone leaves your team.

Every company has a different offboarding process, but access management should be the core focus. Here are some recommended steps to help you manage company passwords when a team member leaves.

Step 1: Help a team member move their data

Important

Do not delete a team member’s account until they’ve transferred the contents of their Employee vault. Deleting an account permanently removes any items saved in an Employee vault, and there’s no way to recover them.

If you use 1Password Business, you can create a Business Watchtower report to make sure a team member’s Employee vault is empty before you suspend or delete their account.

If a team member has any work items in their Employee vault that you’ll need to access later, help them move those items to a vault you both have access to, or create one if needed.

Get help if you need to access a team member's Employee vault after they leave your organization.

Ask the team member if they have any items they need to move to their personal 1Password account. If they don’t have a personal account, they can sign up for one.

On a device where they’re signed in to their work account, the team member should:

  1. Add their personal account to the 1Password app so they can move items to it.
  2. Move any work items from their Employee vault to a shared company vault, and move their personal items to a vault in their personal 1Password account.
  3. Sign in to their personal account on 1Password.com to confirm their personal items were moved.
  4. Sign out of the account(s) they don’t want to keep on the device. For example, if it’s a company device, sign out of their personal account.

After they’ve moved work items to a shared company vault, check the shared vault on 1Password.com to confirm all the items are there.

Step 2: Suspend a team member’s access

After a team member has transferred their personal and work items, suspend their account temporarily.

Tip

If a team member is using their free 1Password Families membership, their family account becomes read-only when you suspend or delete them from your team’s 1Password account. They won’t lose any items saved in their family account, but they’ll need to add a payment method to continue their subscription.

Step 3: Change shared passwords

To make sure that someone who no longer works at your organization can’t access company data, reset or change passwords and tokens that were shared with them:

  1. Sign in to your account on 1Password.com.
  2. Select People in the sidebar, then select the name of a team member. You’ll see a list of vaults they had access to.
  3. Check which vaults have been shared with the groups they belong to. If they belong to the Owners or Administrators group, assume they accessed every password in the vaults they can manage.
  4. Change the password for each item in the applicable vaults.

1Password Business

Create a usage report for a team member to help you prioritize which account passwords to change. The report shows which items were accessed in the last 12 months and the actions performed.

You can only see items a team member has accessed in vaults you also have access to. If possible, get an owner to create the report.

Step 4: Remove a team member from 1Password

After you’ve taken care of all the team member’s data, you can permanently delete their 1Password account and close all their other work accounts.

If the team member is managed with automated provisioning, you’ll need to deprovision them in your identity provider before you can delete their 1Password account.

Get help

If a team member leaves your organization without transferring work-related items from their Employee vault, you can access the vault through account recovery. Someone with permission to recover accounts and access to the team member’s email can initiate the recovery and create a new Secret Key and account password. You can then sign in to the team member’s account and move any work-related items to a shared vault.

Learn more


Published: