Best practices for offboarding employees or organizations
Topic
This article discusses best practices for removing access to Unified Backup devices and accounts as part of the employee offboarding process.
Environment
- Datto SIRIS
- Datto ALTO
- Datto NAS
Description
This article outlines the procedure to deactivate or offboard an employee or organization and remove their access to the Partner Portal and BCDR Appliances. If you have access to multiple Datto products (such as RMM, Datto SaaS Protection, or Autotask PSA), you must preform steps for each product individually to completely remove access.
In the BCDR Portal

- In the Datto Partner Portal, click the Admin tab, then select Manage Employees from the drop-down menu.
- Find the employee you wish to offboard and click the vertical ellipsis icon. You will have two options: Deactivate Account and Delete Account.
- Deactivating the account will prevent the user from logging in. You can reactivate the account in the future.
- Deleting the account will permanently remove the employee user account.
If the employee you are attempting to remove is the primary account holder or a security administrator, only another security administrator can remove that account. See Assigning a Security Administrator for more information.

- In the Datto Partner Portal, click the Admin tab, then select Manage Organizations from the drop-down menu.
- Find the organization you wish to offboard and click the pencil icon. You will have two options: Deactivate Account and Delete Account.
- Scroll down to the Users section and click the vertical ellipsis icon for the organization you wish to offboard. You will have two options: Deactivate Account and Delete Account.
- Deactivating the account will prevent the user from logging in. You can reactivate the account in the future.
- Deleting the account will permanently remove the employee user account.
It is possible to add the same user to multiple organizations. If you have added an organization user account to multiple organization accounts, you must remove that organization user from each location.

- In the Datto Partner Portal, click the Admin tab, then select Portal Email Alerts from the drop-down menu.
- Make sure the account has been removed from both the Primary Email and Sales/Marketing Email categories.
- Scroll down to the Customize Email Alerts card and make the account has been removed from the following sections:
- Portal changes
- Roundtrips
- Billing

You must perform this step for each device to which the user account was assigned.
- In the Datto Partner Portal, click the Status tab,then select BCDR Status from the drop-down menu.
- Click the device hostname to launch the Device Details page.

- In the Datto Partner Portal, click the Admin tab, then select Settings from the drop-down menu.
- Update the Company Contact information to reflect the new user.
On the local BCDR appliance
You must perform these steps for each device to which the user has access.

- In the device's Remote Web UI, click the Configure tab, then select Device Settings from the drop-down menu.
- Scroll to the Local Users section and delete the associated user account. If this is a shared account, remove the account entirely and create a new one with a new username and password. Datto does not recommend using shared accounts.

On the Device Settings page, scroll down to Device Alerts Email Address, delete the user's email address if present, and replace it with the new alert recipient's email address.

- In the local web UI, click the Protecb tab, then select Configure Agent Settings from the drop-down menu.
- Scroll to the Agent Alerts options, then uncheck the box for each agent alert type, then click Apply. Selectijng APPLY TO ALL will modify every agent to reflect the email notification configuration you are viewing. Only do this if you do not have individual agents configured with priority email addresses.

- In the local web UI, click the File Share tab, then select Configure Agent Settingsfor the shares you need to modify.
- Scroll down to Reporting and Alerting and update the email address for each subsection, then click Apply.
- Growth Report
- Critical Error Alerts
- Warning Notices
- Log Digests
Selecting APPLY TO ALL will modify every agent to reflect the email notification configuration you are viewing. Only do this if you do not have individual agents configured with priority email addresses.