Why Small Businesses Should Check Old Devices Still Signed In to Work Accounts

When a small business replaces a laptop, upgrades a mobile phone or lets a member of staff take home a newer device, the focus is usually on getting the new kit working quickly. That makes sense. People need to get back to work.

The problem is what gets left behind.

In many small businesses, old devices are not fully removed from Microsoft 365, Google Workspace and other cloud services. They may still be signed in to email, cloud storage, Teams, OneDrive, Google Drive, saved browser sessions or password managers. The device might be sitting in a drawer, handed to a staff member as a personal device, passed to a family member or waiting to be recycled. Either way, it can still represent a route back into business systems.

That is why reviewing old device sign-ins is such a useful, low-effort habit. It helps you keep control of who and what can still reach your business data.

Why old devices create a real risk

A device does not need to be your main work machine to cause a problem. If it still has a valid session, remembered password or access token, somebody may be able to open business information without going through your normal checks.

For a UK SME, that can create several practical risks:

• Lost or stolen devices may still open work email or files.
• Replaced staff devices may still be connected after a role change or leaver process.
• Shared home devices can blur the line between business and personal access.
• Old laptops in storage may miss updates, making them less secure if they are ever switched back on.
• Saved cloud sessions can bypass the assumption that "nobody uses that device any more".

This is especially important for businesses using Microsoft 365 or Google Workspace, because so much day-to-day work now happens in the cloud. Access to one signed-in device can mean access to email conversations, customer files, shared folders, calendars and internal documents.

What this looks like in real life

Imagine a small firm in Bolton replaces three laptops after renewing staff devices. The new laptops are enrolled properly and everyone carries on working. The old ones are stacked in a cupboard to deal with later.

Months pass.

One of those older machines is eventually turned on to "grab an old file". It still opens a browser that is signed in to Microsoft 365. Email, OneDrive and Teams all load without much resistance because the session was never properly cleared and the device was never removed from the account list.

No breach has happened yet, but the business has quietly lost control over where access still exists.

This is the sort of small gap that often goes unnoticed until there is a problem. Good IT support is not only about setting up the new device properly. It is also about closing down the old access properly.

A simple review process for small businesses

The good news is this is usually not difficult to improve.

Start with a simple checklist:

1. Review your device list in Microsoft 365, Entra ID, Google Workspace or your device management platform.
2. Look for old, duplicate or unfamiliar devices linked to current and former staff.
3. Check leavers and role changes to make sure devices from previous users are no longer trusted.
4. Sign out or revoke access for anything no longer in business use.
5. Confirm the device itself has been wiped or reset before reuse, disposal or recycling.
6. Document the handover process so replacements always include removal of the old device.

If you work with a managed IT provider, this should be part of normal device lifecycle management. It is one of those behind-the-scenes disciplines that protects the business without disrupting the team.

Pay particular attention to these areas

Some devices deserve an extra look:

• Directors' phones with email, authenticator apps and cloud file access
• Shared laptops used for hybrid work or temporary cover
• Personal phones previously used for work email
• Old devices belonging to leavers
• Machines kept as "spares" but rarely updated or checked

For many North West SMEs, the risk is not a sophisticated attacker. It is loose day-to-day habits that build up over time. A calm review process can remove those weak points before they become a bigger issue.

Why this supports business continuity too

This is not just about cyber risk. It also helps with support, compliance and day-to-day control.

When your device list is tidy and accurate, it becomes easier to:

• know which devices are genuinely in use
• support staff faster when there is an issue
• prove better control over business data
• reduce confusion during staff changes
• make future audits, migrations and renewals simpler

That fits the wider goal behind Managed IT Support: keeping your technology manageable, predictable and properly looked after. Your Technology, Managed the Right Way, is not only about the shiny new laptop on day one. It is also about the discipline of removing access from the old one on day two.

What to do next

If your business has replaced phones, laptops or tablets in the past year, now is a good time to review which old devices still appear in your work accounts.

A short monthly or quarterly check can make a real difference. Start with key users, leavers and any devices sitting in drawers or cupboards waiting to be dealt with.

If you are not sure whether old devices are still connected, Managed IT Support can help you review your current setup, remove stale access and build a cleaner process for future device changes.