A new salesperson starts Monday morning. They need email, a computer, access to the dealership’s CRM, dealer management system (DMS), OEM portals, and whatever other applications are required to do the job.
A few months later, someone in accounting leaves. Their Microsoft 365 account gets disabled, but what about the DMS? The payroll system? A lender portal? An OEM login? A vendor application that IT did not know they were using?
That is what makes employee onboarding and offboarding more complicated at an auto dealership than simply creating or deleting an email account.
A good process should make sure new employees receive the access they need to do their jobs without being given access they do not need - and departing employees lose access to every dealership system they used when that access is no longer appropriate.
For most dealerships, accomplishing that consistently requires coordination between management or HR, IT, department managers, and sometimes outside technology vendors.
Why Dealership Employee Onboarding and Offboarding Gets Complicated
A dealership employee rarely uses just one system.
Depending on the person's job, access might include:
- Dealer management system (DMS)
- Customer relationship management (CRM) system
- Microsoft 365 or Google Workspace
- OEM portals
- Lender and F&I systems
- Service or parts applications
- Accounting and payroll systems
- Shared files and folders
- Phones and voicemail
- Wi-Fi
- Remote access
- Vendor websites and applications
Different people may control different accounts. IT may manage Microsoft 365 and the computer, while the DMS provider manages DMS access. A department manager may request an OEM account, and another vendor may control a separate service application.
That works as long as everyone knows what needs to happen.
The problem comes when there is no single process tying everything together. A new employee may spend their first morning waiting for access because nobody requested an account. A departing employee may be removed from email while an account in another system remains active because everyone assumed somebody else handled it.
The solution is not necessarily another piece of software. It starts with one documented process and clear ownership.
What Should Happen Before a New Dealership Employee Starts?
Good onboarding should begin before the employee arrives whenever possible.
The objective is straightforward: when that person sits down to work, the basic technology they need should already be available, configured, and appropriate for their role.
1. Identify What the Employee Actually Needs
Start with the position, not another employee's account.
It can be tempting to say, “Give the new person everything John had.” That may be convenient, but John may have accumulated additional permissions over several years that the new employee does not need.
Instead, determine what access normally belongs to the role.
A salesperson, service advisor, controller, technician, and F&I employee should not necessarily have the same access to dealership information.
This is the principle of giving people access based on legitimate business need. The FTC Safeguards Rule also requires covered financial institutions to implement and periodically review access controls and determine whether people still have a legitimate business need for access to customer information.
2. Create Individual Accounts
Whenever the system supports it, employees should have their own accounts rather than sharing usernames and passwords.
Individual accounts make it easier to control permissions, remove access when someone leaves, and understand who is using a system.
This becomes particularly important when customer or financial information is involved.
3. Set Up Multi-Factor Authentication
Multi-factor authentication, or MFA, adds another verification step beyond a password.
For dealerships subject to the FTC Safeguards Rule, the FTC specifically identifies MFA as one of the safeguards required for individuals accessing covered information systems, subject to the Rule's provisions regarding equivalent controls.
MFA should be addressed during onboarding rather than left for the employee to configure later.
4. Prepare the Employee's Computer and Other Equipment
The employee should receive a computer that is configured according to the dealership's standards rather than whatever happened to be available in a closet.
That may include the appropriate applications, security protections, updates, printers, browser settings, email, and other tools necessary for the person's role.
The same principle applies to phones, tablets, or other dealership-owned devices.
A consistent setup also makes support easier. When computers are configured differently from one employee to another, troubleshooting becomes unnecessarily complicated.
5. Provide the Right Access to Files and Applications
An employee should not receive access to every shared folder, application, or dealership system simply because doing so is easier.
Finance may require information that sales does not. Management may require access that service does not. Someone who changes positions may need permissions added or removed.
The onboarding process should therefore document which systems and information the employee has been authorized to use.
6. Include Security Training in Onboarding
New employees should understand basic expectations around passwords, MFA, suspicious emails, customer information, and dealership systems from the beginning.
The FTC Safeguards Rule requires covered financial institutions to provide security awareness training and keep that training current.
From an operational standpoint, this also gives employees a clear answer to a practical question:
What should I do if something does not look right?
They should know who to contact rather than trying to solve a suspicious email, unexpected MFA prompt, or unusual computer behavior themselves.
The Part That Is Often Missed: Keeping an Access Record
Creating accounts is only half of good onboarding.
Someone should also record what was created.
That does not have to become a complicated administrative project. The dealership simply needs a reliable way to know which systems an employee has access to.
For example:
|
System |
Access Needed |
Account Created |
MFA |
Owner |
|---|---|---|---|---|
|
Microsoft 365 |
Yes |
Yes |
Yes |
IT |
|
DMS |
Yes |
Yes |
Yes/If Supported |
DMS/Admin |
|
CRM |
Yes |
Yes |
Yes/If Supported |
Sales/Admin |
|
OEM Portal |
Yes |
Yes |
As Applicable |
Department |
|
Lender/F&I Systems |
No |
N/A |
N/A |
F&I |
|
Shared Files |
Yes |
Yes |
N/A |
IT |
The exact list will be different for every dealership and every position.
What matters is that someone can retrieve it when the employee changes roles or leaves.
Without that record, offboarding often becomes an exercise in remembering which systems the employee might have used.
What Should Happen When a Dealership Employee Leaves?
Offboarding is essentially onboarding in reverse, but the timing becomes more important.
Management or HR should have a defined way to tell IT and other responsible parties when an employee is leaving, when access should end, and whether there are any unusual circumstances that change the normal process.
From there, the dealership should work through a documented checklist.
1. Disable the Employee's Primary Accounts
Email, Microsoft 365 or Google Workspace, network access, remote access, VPN accounts, and other centrally managed accounts should be addressed according to the dealership's termination process.
Disabling the account is generally preferable to simply changing a password because it provides a clearer way to stop account access while preserving information that may still belong to the dealership.
2. Revoke Existing Sessions
Changing a password or disabling one form of access does not necessarily address every existing login session.
As part of the technical offboarding process, IT should consider active sessions, remembered devices, authentication tokens, remote-access methods, and other mechanisms that could allow an already authenticated device to remain connected.
The underlying principle is simple: ending employment should mean ending the employee's ability to continue using dealership accounts.
3. Remove Access From Dealership-Specific Systems
This is where a dealership-specific checklist becomes particularly valuable.
Do not stop with email.
Review the employee's access to systems such as:
- DMS
- CRM
- OEM portals
- Lender portals
- F&I applications
- Service applications
- Parts systems
- Accounting platforms
- Payroll or HR systems
- Vendor portals
- Website or marketing systems
- Cloud applications
- Shared files
- Remote-access tools
Some of these accounts may be controlled by IT. Others may require a manager or outside vendor to remove the employee.
The offboarding process needs to account for both.
4. Recover Dealership Equipment
Computers, phones, tablets, security tokens, keys, access cards, and other dealership property should be returned and documented.
Before reassigning a device, IT should also make sure business information is preserved appropriately and the computer is prepared for the next user according to the dealership's standards.
5. Preserve and Transfer Business Information
Deleting an employee account immediately can create a different operational problem if important messages, documents, customer correspondence, or other business information disappear with it.
The dealership should determine whether email, files, contacts, voicemail, or other information needs to be retained or transferred to another employee.
This decision should be made as part of the offboarding process instead of after somebody discovers they need a missing file.
6. Review Shared Passwords and Special Access
Ideally, employees use individual accounts.
In the real world, however, dealerships may still encounter shared vendor credentials, equipment passwords, door codes, social-media accounts, or other credentials known by more than one person.
If a departing employee knew a shared credential that remains important to the dealership, determine whether it needs to be changed.
This is another reason individual accounts are preferable whenever a system provides that option.
7. Confirm That Offboarding Is Complete
This final step is easy to underestimate.
Instead of assuming each department or vendor completed its part, someone should confirm that the checklist is finished.
A completed process should give dealership leadership confidence that:
- Dealership-managed accounts have been disabled
- Third-party accounts have been addressed
- Remote access has been removed
- Equipment has been recovered
- Important business data has been preserved
- Any necessary shared credentials have been changed
- The completion of the process has been documented
That last confirmation turns offboarding from a collection of emails and assumptions into an actual business process.
Who Should Own Employee Onboarding and Offboarding?
This is not solely an IT responsibility, because IT often does not know when someone has been hired, terminated, transferred, or given access directly by another department.
It is not solely an HR responsibility either, because HR may not know how to disable accounts, revoke sessions, or preserve business data.
A better structure is to divide responsibility clearly.
Management or HR initiates the process and provides the employee's name, role, department, start or termination date, manager, and timing.
The department manager identifies dealership-specific applications and permissions the employee needs.
IT handles the technology it controls, such as computers, email, security tools, shared files, Microsoft 365, and network or remote access.
Outside vendors or internal system administrators handle applications they control, such as certain DMS, CRM, OEM, lender, payroll, or other specialized accounts.
One person or process should then make sure all of those pieces are completed.
This reflects a broader issue we see in dealership technology: having multiple vendors is not necessarily the problem. Having nobody responsible for coordinating them is.
What About Employees Who Change Jobs but Don't Leave?
Not every access problem involves a termination.
An employee may move from sales into F&I, from one dealership location to another, or into a management position. In those cases, the dealership often thinks about what access needs to be added but not what access should be removed.
Role changes should trigger an access review.
Ask:
- What does this employee need in the new position?
- What did the employee need in the old position?
- Which old permissions are no longer necessary?
- Does the employee now have access to more sensitive information?
- Do any dealership or vendor systems need to be updated?
This keeps permissions from accumulating simply because an employee has been with the organization for a long time.
How Does Employee Offboarding Relate to the FTC Safeguards Rule?
For dealerships covered by the FTC Safeguards Rule, access management is more than an administrative convenience.
The FTC requires covered financial institutions to implement and periodically review access controls, determine whether users continue to have a legitimate business need for access to customer information, use MFA as specified by the Rule, maintain an inventory that includes systems and personnel, and monitor authorized-user activity for unauthorized access.
The FTC's dealership-specific guidance also makes clear that covered dealerships are responsible for an information security program designed to protect customer information and for overseeing service providers that receive or can access that information.
A documented onboarding and offboarding process can support those responsibilities by making access easier to grant appropriately, review, and remove.
This article is not intended as legal advice, and dealership leadership should confirm its specific compliance obligations with qualified counsel or other appropriate advisors.
For a broader discussion of the Rule, see FTC Safeguards Rule for Auto Dealerships: A Practical Compliance Checklist.
A Simple Dealership Employee Onboarding Checklist
Before the employee starts:
- Confirm the employee's role, department, manager, location, and start date.
- Identify the systems required for that role.
- Create individual accounts.
- Assign only the appropriate permissions.
- Configure MFA where required or appropriate.
- Prepare and secure the employee's computer and devices.
- Configure email, files, printers, and other necessary resources.
- Arrange access to DMS, CRM, OEM, lender, service, or other outside systems.
- Provide required security training.
- Document the accounts and access that were provided.
- Confirm the employee is ready to work on the first day.
The goal is not simply security.
It is also a better employee experience. A new employee should not spend the first half of the first day calling different vendors trying to get the tools required to do the job.
A Simple Dealership Employee Offboarding Checklist
When an employee leaves:
- Confirm the exact date and time access should end.
- Disable centrally managed accounts.
- Revoke active sessions and remote access.
- Remove access from DMS and CRM systems.
- Remove OEM and lender portal access.
- Review accounting, payroll, service, parts, and vendor applications.
- Recover dealership-owned devices and equipment.
- Preserve and transfer required business information.
- Review shared passwords or codes the employee knew.
- Confirm each outside vendor or system administrator completed its portion.
- Document completion.
The exact checklist should be customized to the systems your dealership uses.
A 30-person dealership operating from one location may have a different process from a 100-person dealer group with several rooftops. What matters is that the process is repeatable and somebody owns it from beginning to end.
How Often Should a Dealership Review Employee Access?
Onboarding and offboarding address specific employee events, but access should also be reviewed periodically.
People change positions. Vendors change. New applications are introduced. Temporary permissions become permanent because nobody remembers to remove them.
The FTC Safeguards Rule specifically calls for covered businesses to periodically review access controls and reconsider whether users continue to have a legitimate business need for customer information.
A periodic access review gives dealership leadership an opportunity to ask:
- Does this person still work here?
- Is this still the person's job?
- Does the employee still need this level of access?
- Are there old accounts that can be removed?
- Are there shared accounts that should be replaced?
- Are outside vendors still supposed to have access?
These are straightforward questions, but answering them regularly can prevent years of unnecessary access from accumulating.
Frequently Asked Questions About Dealership Employee Onboarding and Offboarding
How quickly should an employee's access be disabled when they leave?
The dealership should establish the exact time access will no longer be authorized and coordinate the offboarding process accordingly. An involuntary termination may require different timing from a planned retirement or resignation.
The important part is that HR or management and the people responsible for account access are coordinated rather than learning about the departure after the fact.
Is disabling an employee's email enough?
Usually not.
A dealership employee may have separate access to the DMS, CRM, OEM portals, lender applications, payroll, accounting, service systems, vendor platforms, remote-access tools, shared files, or other applications.
That is why the offboarding process should be based on the employee's complete access record rather than just their email account.
Who should tell IT that an employee has left?
The dealership should designate a specific person or process, usually involving HR or management, to initiate onboarding and offboarding requests.
IT should not have to discover that somebody left because another employee calls asking what to do with their computer.
Should dealerships use shared accounts?
Individual accounts are preferable whenever the application supports them. They make access easier to manage and provide greater accountability when permissions need to be reviewed or removed.
Some dealership or vendor systems may have limitations, so those situations should be documented and handled based on the capabilities of the particular platform.
Should employee access be reviewed even if the employee still works at the dealership?
Yes. Job responsibilities change, employees move between departments, and access can accumulate over time.
For dealerships subject to the FTC Safeguards Rule, periodic review of access controls is also part of the Rule's requirements for protecting covered customer information.
Does our IT company control every dealership account?
Usually not.
Specialized dealership systems may be managed by the DMS provider, OEM, lender, software vendor, department manager, or another administrator.
A good offboarding process does not assume IT controls everything. It identifies who controls each system and who is responsible for removing access.
Employee Access Shouldn't Depend on Someone Remembering Everything
Employee changes are part of running a dealership. The problem is not that people join, leave, or change positions. The problem is relying on memory and informal emails to manage access across a growing number of systems.
A documented onboarding and offboarding process gives everyone a clearer job to do. New employees can get the tools they need faster, departing employees can be removed consistently, department managers know what they are responsible for, and leadership has a way to confirm that nothing was simply assumed to be handled.
For a dealership with several departments, outside vendors, and potentially multiple locations, that clarity becomes increasingly important as the business grows.
If you are not sure who creates and removes accounts across your dealership today, let's talk about your dealership.
Tech Marvel helps Morris County and Northern New Jersey auto dealerships get a clearer picture of their users, systems, access, cybersecurity, and technology processes.
Schedule your free 20-minute Dealership IT Review.
