Staff turnover in nurseries is high. That is not a criticism, it is just the reality of the sector. People move settings, go on maternity leave, change rooms, step up, step back. Every one of those moves is a moment where access to your systems, your data and your building should change too, and in most nurseries it quietly doesn’t.
This is the guide that ties the loose ends together. It covers what to do when someone joins, when they change role, and above all when they leave, because the leaver is where the real risk sits. It also tackles the thing nobody likes to think about: the shared passwords and door codes that the person who left in 2019 might still know.
There are downloadable forms at the bottom to make the whole thing routine rather than something you reinvent every time.
When someone joins, you are paying attention. You set them up, you show them round, you want them productive. The risk at the start is low because you are watching.
When someone leaves, attention drops away exactly when it shouldn’t. The handover is rushed, the last day is emotional or awkward, and the quiet admin of removing access slips down the list behind covering their room and finding a replacement. Weeks later, that person still has a live email account, still knows the Wi-Fi password, and still knows the code to the front door.
Most of the time that is fine, because most people leave on good terms and never think about it again. But cyber security is not about most of the time. It is about the one person who left under a cloud, or whose personal email later gets hacked, or who simply still has access they should never have kept. You only need to be unlucky once.
Run through this on or before someone’s last day. The downloadable leaver form at the bottom turns this into a tick-box routine.
Disable the Microsoft 365 account on the last working day rather than deleting it. Disabling cuts off access immediately while keeping their emails and files intact for handover, which deleting would destroy. Reset the password, sign them out of all sessions, and remove them from any shared mailboxes or groups. Your IT supplier can do this in minutes if you give them notice.
Collect any nursery phone, iPad or laptop. If devices are managed properly, the person’s work account can be wiped from a device remotely without touching anything personal on it. Make sure the device is removed from the management system so it stops receiving your nursery’s apps and credentials.
This is the part almost everyone misses, and it has its own section below because it matters so much.
Collect keys and fobs. If you use door codes, this is the moment to change them, not “at some point”. If you have proper access control, simply revoke that person’s individual credential, which we cover in the Access Control guide.
Record what you did and when. The leaver form gives you that record, which matters for GDPR accountability and for the awkward day an inspector or an insurer asks how you manage staff access.
Here is the uncomfortable truth about nurseries. You almost certainly have a handful of passwords that everyone knows and nobody owns. The Wi-Fi password. The login for your parent communications app. The camera or CCTV system. The alarm code. The shared admin account for something or other.
These shared credentials are the leaver problem at its worst, because there is no single account to disable. When someone leaves, the Microsoft 365 account is easy, you switch it off. But the Wi-Fi password they have known for three years is still the Wi-Fi password. The parent-comms login they shared with the rest of the room is unchanged. Changing these means changing them for everyone, reconfiguring every device, telling every member of staff the new one, so it never gets done.
The result is that shared passwords accumulate former staff like a ship’s hull collects barnacles. Every leaver still knows them. Over a few years that is a long list of people with access to your systems who no longer work for you.
The fix is to stop sharing passwords as passwords. This is exactly what a password manager like Keeper is built for. Instead of telling people the Wi-Fi password, you give them access to a shared vault that contains it. They can use the credential without ever seeing or memorising it. When they leave, you remove their access to the vault and the credential is gone from their reach, with nothing to change and nobody else inconvenienced.
It turns the shared-password problem inside out. Access becomes something you grant and revoke per person, exactly like it should be, instead of a secret that leaks a little more with every leaver. And because Microsoft 365 can sign people straight into Keeper, it is one login that unlocks everything rather than another password to remember. Less friction, not more.
For the credentials that genuinely cannot live in a vault, like a Wi-Fi password that physical devices need typed in, the answer is managed devices that get new credentials pushed to them automatically. We touch on that in the iPad management guide.
Leavers get the attention. Role changes get none, and they cause a slow, invisible problem.
Someone moves from the baby room to the office. They pick up new access for their new job, which is right. But they keep all their old access too, because nobody thinks to remove it. Do that across a few years and a few promotions and you end up with long-standing staff who can get into almost everything, not because anyone decided they should, but because access only ever got added and never taken away.
The principle is simple: a role change is a leaver and a joiner happening at once. Add what the new role needs, remove what the old role no longer justifies. The role-change form at the bottom prompts you through both halves so the removal does not get forgotten.
Getting the start right makes every later step easier. Set people up with their own named account, never a shared one. Give them access to what their role needs and nothing more, which is the principle of least privilege and the thing that limits the damage if their account is ever compromised. Add them to the right shared vaults rather than telling them shared passwords. Record it on the new starter form so that when they eventually leave or change role, you have a clear picture of what to undo.
A tidy joiner is a tidy leaver waiting to happen. The five minutes of discipline at the start saves the scramble at the end.
The reason leaver admin falls through the cracks is that it sits between two people. HR or management knows someone is leaving. IT, whether that is your supplier or whoever wears that hat internally, is the one who can actually disable the account. If those two do not talk, the account stays live.
The fix is a single routine: whoever processes the leaver on the HR side sends the completed leaver form to whoever handles IT, every time, as a non-negotiable step. No form, no exception. It is not bureaucracy for its own sake, it is the one piece of paper that makes sure the digital and physical access actually gets removed rather than assumed.
The forms below are built to be that handover document.
These are Word templates you can save, brand and adapt to your setting. Print them, or keep them digital, whatever fits how you work.
Adding access is easy and everyone remembers to do it. Removing it is the bit that gets forgotten, and it is the bit that actually protects you. Build the leaver routine around one form that always reaches whoever can switch the accounts off, move your shared passwords into a vault so leaving means losing access automatically, and change your door codes the day someone walks out, not the day you finally get round to it.
Octopus 365 has supported nurseries since 2011, and James has worked with early years settings since 2009. If you’d like a chat about tightening up your joiner and leaver process, or moving your shared passwords somewhere safer, get in touch any time. No hard sell, just a conversation.