Office IT access checklist
Record who should reach your office accounts and client files. Use an approved role, a safe test and a clear handover for staff and supplier changes.
Read the short answerGet the printable worksheet
The short answer
An office IT access check compares approved roles with the access people actually have. Include email, shared files, business applications and administration, then record the evidence and outstanding changes. The business approves permissions; the checklist does not determine legal or contractual compliance.
Your printable worksheet
Record approved staff access, shared file checks and recovery ownership, with a clear action log for arrivals and departures.
You can read the guide and download the worksheet without an email sign up. Keep passwords, recovery codes and private customer records out of it.
Email and staff access
Check role approved access to Microsoft 365 or Google Workspace. Confirm who owns account administration and recovery.
Shared files and client sharing
Use an empty test file to check the shared location and approved sharing permissions. Record the outcome without client records.
Business apps and recovery
Confirm the application owner, support route and recovery evidence. Agree access changes for a staff arrival or departure first.
Name the role and its approver
Record the person or role being reviewed, the business owner approving access and the date. List the work the role needs to do, rather than copying another user's permissions as the starting point. Include contractors and suppliers whose access affects office systems.
Keep personal information in the register limited to what the business needs to manage the task. For a demonstration or support request, use role names and safe test records where possible. A complete list should describe the required access without becoming a store of confidential client information.
Include accounts beyond business email
List Microsoft 365 or Google Workspace alongside practice applications, accounting tools, supplier portals and website administration. Record the business owner of each service and who approves a new user or permission change. Note dependencies such as a licence or vendor managed account.
Confirm the list against the work the person performs. An email account opening successfully does not show that the person can reach the required practice records or that another application no longer holds old access. Mark an unverified entry as a task rather than treating it as complete.
Check shared mailboxes and client folders
Identify the shared inboxes and libraries relevant to the role. Record the intended access, such as reading an enquiry or editing a project file, and the owner who approves it. Review individual storage used for team records before a new starter or departure makes the dependency urgent.
Use a safe representative record to check the intended task. Also test a role that should be refused access when that test is appropriate to the review. Keep the result and setting reference, without copying client content into the checklist.
Review external sharing deliberately
List the client, collaborator or supplier relationships that need access to shared work. Record the purpose, information in scope and the person who approves the invitation or link. Confirm the recipient can perform the agreed task and that the access is limited as intended.
Check the relevant platform settings and the method used to share. A link working for its creator is not evidence of the recipient's experience. Give ongoing guest access a review owner, especially when a project or supplier engagement finishes.
Keep administration and recovery separate
Record who controls the domain, email environment, website and important application subscriptions. Identify the business controlled recovery arrangement and the protected location of its instructions. Keep passwords, tokens and recovery codes out of the worksheet.
Check that an administrator or supplier change will leave the business with an agreed recovery route. Where suitable, scope a review of administrative permissions separately from ordinary staff access. The register should identify who can act and who approves that action.
Plan the records before removing access
For a departure, agree when access ends and which records need to remain available to the business. Identify who receives outstanding enquiries, client work and shared responsibilities. Include the person's devices and specialist applications as well as the main cloud account.
Follow the platform instructions and the business record decision before deleting an account or removing a licence. Microsoft 365 guidance treats access blocking, data handling and account removal as separate steps. Record the approved task and who verifies it, without assuming one deletion completes the handover.
Check the everyday application task
Choose a representative action for the role, such as opening an approved project, producing a test report or reaching a shared template. Record the device, browser or app used and any dependency on a vendor service. Use test information that will not be confused with a live client instruction.
If the task fails, keep the exact error and time with the request. Identify whether the next investigation belongs to the device, identity platform, file service or application vendor. The access review should leave a clear action rather than granting broader permissions until the screen opens.
Keep the evidence and review date
For each item, record the approved access, evidence checked, reviewer and date. Give any open change an owner and a way to verify it. Review the relevant entries when someone changes role, a supplier leaves or a new application is introduced.
A Dark Cloud Creative can discuss office IT support from Perth, with remote help across Australia where the task suits it. Send the gap, system name and effect on the team. Client contractual requirements, formal assessments and legal interpretations need their own defined scope.
Is this checklist a compliance assessment?
No. It helps record approved access, evidence and open tasks. A contractual requirement, formal assurance opinion or legal interpretation needs an appropriate scope and responsible adviser.
Should we delete a departing employee's account first?
Agree the access end point and the required record handover before deleting an account or removing a licence. Follow the instructions for your platform and confirm any retention requirements with the appropriate business owner or adviser.
Can this be used with Google Workspace?
Yes. The role, ownership and evidence questions apply to Google Workspace as well as Microsoft 365. Use the permissions and departure process supported by your actual platform and subscription.
Sources and further reading
These links take you to the publisher's guidance. Product details and requirements can change, so check the current source before making a change.
Content reviewed on 8 October 2026. This guide is a starting point. The scope of a support job depends on your systems, access and business requirements.