Your IT Person Is Going on Vacation. Who Can Access Everything If Something Goes Wrong?

Your IT person is taking a week off. Before leaving, they say what they always say: "You've got my number if anything happens."

Imagine Tuesday morning. Nobody can open the shared files. You call someone for help. They ask where the files are hosted, who has administrator access and whether anyone can authorize changes.

Every answer points to the person on vacation.

A useful handover gives another qualified person the access, information and authority to act. It also gives your usual IT person a reasonable chance of switching off. If you are that person, you may want to forward this to whoever approves your time and budget. Preparing coverage takes working hours, and those hours belong on the schedule.

If you only have two minutes

1. List the accounts that run the business and confirm the business owns each one.
2. Make sure the covering person has their own named sign-in, and that it works.
3. Write a one- or two-page handover guide with a vendor contact table.
4. Name who can approve urgent work and spending.
5. Run the five-task walkthrough before leave starts.

How one person becomes the answer to everything

In a small business, this happens gradually. Someone sets up Microsoft 365, fixes the Wi-Fi and deals with the accounting software supplier. Nobody plans it, and over the years the business grows around one person's memory.

That person might be an employee, an independent technician or the office manager who inherited IT along with everything else. The unwritten knowledge is usually small and specific: the setting that keeps the label printer working, the renewal that arrives by email every March.

That knowledge represents years of useful work. Passing it to a substitute takes working time, management support and someone qualified to receive it. A "quick handover" on Friday afternoon leaves room for none of those.

Start with the systems your business needs to work: email, shared files, Internet, phones and essential applications. For each, ask who could get help today if your usual contact were unreachable.

Check access before you need it

Knowing a password is only part of gaining access. The sign-in may also require an approval on the absent person's phone, a security key in their bag or a recovery message sent to an account nobody else controls.

Confirm which accounts control your domain registration, Microsoft 365 environment, Internet service, network equipment and backups. Check who is listed as the owner, which email address receives recovery messages and who pays the bill. The business should keep control of these services and their recovery arrangements, even when an outside provider administers them.

Store credentials in a password manager controlled by the business, with access limited to authorized people. Give the covering technician a named account where the system supports it, with the permissions needed for the agreed work. Shared logins make it hard to tell who did what. Test the covering person's sign-in and multi-factor authentication before departure. Emailing the administrator's password or turning off MFA to make coverage easier creates avoidable exposure.

Ask IT about a separate emergency access arrangement for an administrative lockout. Microsoft publishes guidance on emergency access accounts in Microsoft Entra, the identity service behind Microsoft 365. These powerful accounts need protection, monitoring and testing. Ordinary vacation tasks should use the covering person's own established access. The Microsoft page is a technical reference for whoever configures the arrangement.

Write the handover someone else would need

Begin with a one- or two-page guide to finding help and information, linking to detailed technical procedures where they exist. Include:

• Critical systems, their purpose and where they are managed.
• Where authorized staff can find credentials and recovery procedures.
• Known problems, important dependencies and changes already in progress.
• The backup service, alert recipient and recovery contact.
• Renewals or scheduled work falling during the absence.

Write down the details a capable technician could not guess, the ones that live only in someone's head. Keep the guide in an approved location the covering person can reach if company email or the usual shared drive is unavailable. Protect sensitive information, keep passwords in the password manager and record when the guide was last checked.

A vendor list belongs alongside it. Copy this structure and fill it with your own details:

Confirm the authorized callers with each vendor. A name in your document does not give that person permission on the supplier's account.

Who is allowed to make the call?

A technician may have access and still be waiting for a decision. Can they order replacement equipment? Take the accounting system offline? Restore yesterday's data if that would overwrite work completed this morning?

Name a business decision-maker and a substitute. Record what each can approve, any spending limit and how to reach them. The technician should explain the consequences of a proposed action so the business can make an informed decision.

An office manager can coordinate calls, collect information and authorize spending within agreed limits. Technical diagnosis and recovery need someone with the relevant skills. Make both responsibilities explicit.

Name the person who will handle a recovery

For backups, ask three questions: who receives failure alerts, who can access the backup system and who knows how to recover what the business needs?

Check that alerts reach the covering technician during the absence. Identify the latest successful restore test and where its results and recovery instructions are recorded. If a restore requires an encryption key or a supplier's assistance, include the secure access route and contact details.

Give the covering person enough context to set priorities. Restoring the folder needed for today's deliveries may matter before recovering an archive. Decide who can approve recovery choices when time or recent work could be lost.

If nobody can answer these questions, record the gap and arrange the preparation before leave begins.

Agree on what happens when something breaks

Tell staff who to contact, through which channel and during what hours. Include a phone number or another trusted route for times when email is unavailable or potentially compromised.

Define what needs urgent attention by business impact, security risk and agreed coverage hours. An office-wide outage or a suspected security incident needs prompt escalation. One locked-out employee may be a minor inconvenience, or may stop payroll or dispatch. A printer fault may wait, or may stop shipping. Write examples that fit your business instead of copying a generic list. Account changes for a known new hire can be scheduled beforehand, while urgent access removal still needs a clear route.

Our guide to what to do after an employee clicks a phishing link is a useful incident-response reference for the coverage guide.

Confirm who handles requests when the first contact does not answer, and who can attend onsite if necessary. For Montreal businesses, check onsite coverage and French-language support as part of the arrangement.
Agree with the person taking leave which exceptional situations warrant contacting them. Without that, "call whenever" tends to become the default procedure.

Arrange coverage without adding another position

An outside support provider can cover agreed tasks while your internal IT person is away, or share ongoing responsibilities through a co-managed arrangement. Set this up early enough for the provider to understand your environment and test access.

Ask which systems they support, their hours, how urgent requests are handled, when onsite help is available and what costs extra. Confirm how their permissions are limited, when temporary access is removed and how the business keeps its documentation.

Budget for the preparation as well as the coverage. Documentation, account setup and a walkthrough take time. Our small-business IT budgeting guide can help place that work alongside your other support costs.

Try a 30-minute handover walkthrough

Before departure, ask the covering person to walk through the shared-files scenario from the opening. Let the usual IT person observe and note what is missing.

Use safe checks. This short walkthrough can expose missing information. A real restore test or disruptive system change needs its own planned work. Assign each gap to someone and confirm it is resolved before leave starts.

If your next vacation would still leave the business without technical coverage, talk to Syslogic about support alongside your existing IT person. Bring your handover guide, including the unanswered questions. The person taking leave should be able to trust the coverage, too.