Stop the Password Shuffle: Managing Access When Employees Join or Leave Your Brisbane Business

Summary

This guide helps you troubleshoot and resolve: Stop the Password Shuffle: Managing Access When Employees Join or Leave Your Brisbane Business. Follow the steps below to fix the issue.

Common Causes

Managing employee access is one of the most common security risks for Brisbane businesses. When a new hire starts, manual software installation and account configuration can delay productivity for days. When an employee leaves, failing to revoke access immediately leaves your business files and applications vulnerable to unauthorised access. By moving to a modern workplace setup using Microsoft Intune and Windows Autopilot, you can automate onboarding and ensure instant offboarding.

Quick Fix Steps

1. Enrol new devices in Windows Autopilot for zero-touch deployment.
2. Assign the user to the correct Microsoft Entra ID group to receive apps and policies.
3. Have the employee log in with their business email to automatically configure the device.
4. Disable the user account and initiate a remote wipe during offboarding.

Detailed Instructions

Setting Up Stress-Free Onboarding

Instead of manually installing software on every new PC, use Windows Autopilot and Microsoft Intune to deliver a pre-configured experience. Ensure you have the appropriate licences (such as Microsoft 365 Business Premium or E3/E5) that include Intune and Autopilot rights.

1. Purchase hardware from a vendor that supports Windows Autopilot and ensure the device hash is uploaded to your tenant.
2. Sign in to the Microsoft Intune admin centre.
3. Navigate to Devices > Windows > Windows Autopilot deployment profiles.
4. Create or edit a deployment profile and set the deployment mode to User-driven.
5. Assign the profile to the appropriate Microsoft Entra ID group containing your new hires.
6. Under Apps, assign required business applications (such as Microsoft 365 and line-of-business software) to the same user or device group.
7. Configure compliance policies under Devices > Compliance policies to enforce security settings like encryption and password requirements.
8. When the new employee receives the sealed laptop, they power it on and connect to the internet.
9. The employee logs in with their business email address. Windows Autopilot automatically joins the device to Microsoft Entra ID, enrols it in Intune, and installs all assigned apps and settings.

Note: Encourage employees to use their business email address from day one. This ensures their profile, OneDrive files, and application licences are tied to your organisation, not a personal Microsoft account.

Performing Instant Offboarding

When an employee leaves your organisation, you must revoke access immediately to protect company data. Before wiping a device, ensure any important OneDrive or SharePoint files are backed up or transferred to another user.

1. Sign in to the Microsoft Entra admin centre.
2. Navigate to Users > All users.
3. Select the departing employee's account.
4. Select Revoke sessions to sign them out of all active devices instantly.
5. Set the user account to Block sign-in or delete the account based on your retention policy.
6. Return to the Microsoft Intune admin centre and navigate to Devices > All devices.
7. Select the employee's assigned corporate device.
8. Choose Wipe to restore the device to factory settings and remove all company data.
9. If the device is being reassigned, mark it as Autopilot ready after the wipe completes so the next hire can set it up with zero-touch deployment.

Warning: Revoking sessions and blocking sign-in should be done simultaneously during the exit conversation. Delaying either step leaves a window where the former employee could still access email, files, or cloud applications.

Troubleshooting

Device Does Not Receive Apps After Login

• Verify the device is connected to the internet during the initial setup.
• Check that the user is a member of the correct Microsoft Entra ID group in the Intune admin centre.
• Ask the employee to open Company Portal and select Sync to force a policy check.
• Confirm the device shows as Enrolled and Compliant in Intune.

Former Employee Can Still Access Company Data

• Ensure Revoke sessions was executed in Microsoft Entra ID.
• Check for any shared mailboxes, Microsoft Teams channels, or third-party applications where the user may have separate credentials.
• Verify the device wipe completed successfully in the Intune device list.
• Change passwords for any shared service accounts the departing staff member knew.

Windows Autopilot Profile Not Applying

• Confirm the device hardware ID was registered with your tenant before delivery.
• Ensure the deployment profile is assigned to the correct group and not in conflict with another profile.
• Check that the device has a stable internet connection during Out-of-Box Experience (OOBE).

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?