5 things to do with a Mac the day an employee leaves

The exit conversation is at two o’clock and the MacBook comes back at four. What happens between those two hours is the difference between a device you can reissue on Monday and one that sits in a drawer for a month while somebody argues with a support queue. In order of urgency.

1. Suspend the identity account first

Whether identity lives in Microsoft Entra ID, Google Workspace, or Okta, suspending the account cuts mail, file access, and every single sign-on session in one action. Do this before anything else, because every step that follows is simpler once the person cannot reach anything. Suspend rather than delete: deleting the account can take the mailbox and the cloud file contents with it, and you will want both later.

2. Confirm the Mac is reachable, then lock or wipe it

Check in your MDM (Jamf, Mosyle, Kandji, SimpleMDM) that the device has checked in recently, not that it is merely listed. If the handover is anything other than hand to hand, issue a remote lock with a recorded PIN, or a full wipe, while the Mac is still on a network you can reach. A command sent to a Mac that has already gone offline sits queued until the next check-in, which may never come.

3. Clear Activation Lock while you still can

If the person ever signed in to Find My with a personal Apple ID, that Mac is Activation Locked to them. Cleared through Apple Business Manager or your MDM before the account is untangled, it takes a minute. Discovered after the fact, it becomes a documentation exercise with Apple involving original proof of purchase, and until it is resolved the Mac cannot be set up by anyone else.

4. Reclaim the assigned software licenses

Adobe Creative Cloud, Microsoft 365, Figma, and most design and project tools keep billing for an assigned seat whether or not anyone signs in to it. Unassign the person in each admin console on the same day and record where the seat went. A seat that has been quietly renewing for a year is a credit conversation with a vendor, not a refund.

5. Rotate shared credentials and release the device record

Anything the person knew and shared should be changed, not just noted: the office Wi-Fi passphrase, vendor portal logins, the alarm code, any service account they had the password for. If the Mac is being retired rather than reissued, release it from Apple Business Manager as well, so it stops counting against your fleet and stops trying to auto-enrol the next time it is wiped.

If you only do one thing

Suspend the identity account before the person leaves the building. It closes mail, files, and sign-ins in a single move, and it buys you the time to do everything else properly instead of at speed.