Access management
A shared mailbox handover checklist for departing staff
A practical checklist for moving a shared mailbox from a departing employee to a role owner without losing customer messages, forwarding rules, or audit evidence.
Start with repeatable IT work that has a clear owner, clear access limits, and a review cadence. Keep risky technical decisions with the manager or provider who owns the system.
Delegation playbook
On this pageJump to section
A departing employee rarely leaves only an empty desk. They leave a shared mailbox that customers still write to, a calendar that colleagues depend on, and rules that may quietly forward messages to a personal address. If the mailbox is handed over in a hurry, the company loses correspondence and the next owner inherits a puzzle. A written checklist makes the transfer predictable and gives the reviewer a way to confirm that access closed on the last day.
Why the mailbox outlives the employee
A shared mailbox is usually tied to a role rather than a person, even when it carries one name. Sales enquiries, support requests, and invoices can keep arriving for months after the role changes hands. The account also holds the history that explains a customer relationship or a disputed invoice. Treating it as personal property makes the handover harder, because the person leaving may be the only one who knows which folders matter. Start by treating the mailbox as a company record.
The risk is not only lost email. A forwarding rule to a personal address can continue after the account is disabled, and a delegate may still open the mailbox from an old session. Those are access paths that often sit outside the offboarding checklist. Write down every path before the last day, including mobile mail apps, delegated calendars, and connected tools. The person leaving should confirm the list while the details are still fresh.
Inventory the mailbox before the last day
Export the mailbox settings while the account still works. Capture the address, aliases, forwarding rules, delegates, shared calendar permissions, and any application that signs in with the mailbox. Take a screenshot or a configuration export for each item and store it with the handover record. Do not rely on the departing employee's memory for settings that a customer may depend on. The export is the baseline for the final check.
List the folders that hold active work rather than every folder in the account. Ask the manager which conversations are still open and which can be archived. Record the owner of each open thread so the next person knows who is waiting for a reply. A folder called Old might contain the only copy of a signed contract. The inventory should make that visible before the account is closed.
Separate ownership from access
Decide who owns the mailbox after the handover, then decide who may read it. Ownership means the person who answers for the correspondence and approves changes. Access means the people who need to work inside it day to day. These are often different, and confusing them creates either a bottleneck or an uncontrolled shared login. Record both names in the handover note.
Remove personal delegates and replace them with a group or a named role account. A group is easier to audit and survives individual turnover. If the company must keep a named delegate, set a review date and a reason beside the permission. Do not leave the departing person as a delegate just in case. A temporary exception that nobody reviews becomes a permanent back door.
Move the alias and forwarding deliberately
Aliases are the addresses customers already use, so they matter more than the mailbox name. Move each alias to the new owner only after the destination is tested. Check that replies arrive from the expected address, because a mismatch can confuse customers and break automated replies. Update the signature, the auto-reply, and any saved templates at the same time. A half-moved alias is worse than a planned delay.
Forwarding rules deserve special attention because they are easy to create and easy to forget. Remove rules that send mail outside the company before the account is disabled. If a rule is still needed, rewrite it to an approved internal destination and record who approved it. Forwarding to a personal address should be treated as a data transfer, not a convenience. The handover record should show that the rule was removed or replaced.
Archive without breaking the audit trail
Keep the mailbox archive in a system the company controls, with a retention period that matches policy. Do not export to a personal drive or a zip file on a laptop. Give the archive a clear name, a date, and a record of who authorized it. The next reviewer should be able to find a message without asking the former employee. If the archive is searchable only by one person, it is not really an archive.
Record what was archived and what was deleted, including the approval for each action. Some messages must be kept for legal or contractual reasons, while others can be removed under the retention schedule. Do not let the departing employee decide alone. A short disposition note protects the company and gives the new owner a clean starting point. It also shows an auditor that the decision was deliberate.
Test the handover from the customer's side
Send a test message to each alias and confirm it reaches the right person. Reply from the new address and check that the signature, display name, and reply-to address are correct. Ask a colleague outside the mailbox team to try the same steps, because they will notice a confusing auto-reply that insiders ignore. Test the calendar and the shared folders too, not only email. The handover is complete only when a customer would experience a normal exchange.
Close the account on the agreed date and recheck the forwarding rules and delegates afterward. Keep the handover note with the ticket so the next reviewer can see what changed. Set a review date thirty days later to catch mail that still arrives at the old address. If something fails, the note tells you who approved the original setup. A tested handover takes an hour and prevents months of lost messages.
Sources and next step
Use the CISA Cross-Sector Cybersecurity Performance Goals and the NIST Cybersecurity Framework 2.0 as primary references for the access, asset, and recovery practices discussed in this guide. Apply your own policies, contracts, and system documentation to the workflow. Compare this guide with the shared mailbox handover checklist and the maintenance window notice guide before changing a live process.
Keep decisions, approvals, and evidence in systems the business already controls. If the coordination is recurring and your technical owner can define the boundaries, review the IT virtual assistant service areas and contact ITVirtualAssistant to discuss a limited pilot.
Operating brief
What this guide should help you decide
Routine intake, status updates, records, screenshots, and documentation upkeep.
Approvals, risky system changes, security decisions, and final technical judgment.
How to use this guide
Use this page to decide what an IT virtual assistant should handle first. If the task is recurring, documented, and easy to review, it is usually a better first delegation candidate than work that requires live technical judgment.
Treat the article as an operating brief, not just a topic overview. The goal is to turn loose IT work into a named workflow with inputs, outputs, permissions, review cadence, and a handoff rule that protects the business while reducing manager load.
Workflow
Recommended operating workflow
Define the request
Write what a shared mailbox handover checklist for departing staff means in your company, where requests enter, and what finished work looks like.
Limit the access
Give the assistant only the tool permissions needed for intake, records, status updates, or documentation.
Run a pilot
Use a two-week sample period so the manager can review accuracy before expanding the workflow.
Review patterns
Summarize repeat issues, blocked requests, and escalation volume so the technical owner can improve the process.
Decision rules
| Question | VA fit signal | Escalate when |
|---|---|---|
| Is the work repeatable? | The same request appears weekly and can be described in steps. | The request changes business policy or system design. |
| Can quality be reviewed? | The manager can inspect the output without redoing the work. | Only a senior technical person can judge correctness. |
| Is access contained? | The assistant can work with read-only or role-limited access. | Admin rights, customer data, or security settings are involved. |
Delegation checklist
- Write the intake source, expected output, and manager review cadence.
- Confirm the assistant has only the permissions needed for the workflow.
- List the events that require escalation before work continues.
- Track examples for two weeks before changing the workflow.
- Save examples of good and bad outputs so the assistant has concrete references.
- Review the workflow monthly and remove permissions that are no longer needed.
Example first-week agenda
Day one should cover the workflow owner, tools, allowed actions, forbidden actions, and escalation language. By the end of week one, the assistant should have produced a small sample of completed work, a list of unclear requests, and a manager-reviewed improvement note.
What to review before delegating
Confirm the owner, access level, review cadence, and escalation path before assigning any recurring IT workflow to a remote assistant.
What should an IT virtual assistant handle first?
Start with repeatable, reviewable work such as ticket summaries, account records, documentation updates, and checklist follow up.
Get free IT support review