How to Manage Employee and Volunteer Access at Your Nonprofit
Nonprofits rely on employees, volunteers, contractors, and temporary staff to support their programs and daily operations. Each person may need access to email, shared documents, donor management platforms, scheduling tools, or financial systems.
Managing that access becomes difficult when responsibilities change or people leave the organization. Former volunteers may retain access to shared folders, employees may have permissions they no longer need, and important accounts may be tied to individuals who are no longer involved.
Nonprofit access management helps organizations control who can use their systems, what information they can access, and when those permissions should end.
A consistent process protects organizational information while allowing employees and volunteers to perform their responsibilities. For nonprofits without dedicated IT staff, an experienced IT support provider for nonprofits can help establish and maintain these procedures.
Start by Defining Who Needs Access to What
Before creating an account, determine which applications and information the person needs to perform their responsibilities.
An executive director, development coordinator, volunteer, and external accountant should not automatically receive the same permissions.
The goal is to provide sufficient access for each role without exposing unrelated organizational information.
Typical Access Requirements by Nonprofit Role
| Role | Typical access needed | Access that may be unnecessary |
|---|---|---|
| Executive director | Leadership documents, organizational reporting, approved financial information | Technical administrator privileges for everyday work |
| Development staff | Donor CRM, fundraising documents, campaign communications | Confidential HR records or unrestricted accounting access |
| Finance staff | Accounting software, financial reports, approved payment systems | Unrelated program or personnel files |
| Program coordinator | Program documents, scheduling, participant communications | Organization-wide financial or administrative records |
| Volunteer | Specific project documents, scheduling tools, approved applications | Permanent access to organizational systems |
| External contractor | Resources required for a defined engagement | Unrestricted access to shared drives or administrative settings |
These examples should be adjusted to the organization's actual responsibilities.
This approach is commonly called least privilege: each person receives only the permissions necessary for their work.
For executive directors and operations managers, the practical question is straightforward: Can we explain why each person has access to the systems they use?
If the answer is unclear, permissions may need to be reviewed.
Create a Consistent Onboarding Process
Employee and volunteer onboarding should include more than providing an email address and password.
A consistent process helps prevent unnecessary permissions, unmanaged accounts, and confusion over who is responsible for granting access.
Before the Person Starts
The manager or program coordinator should identify:
- Which applications and shared folders the person needs
- Whether an organizational email account is necessary
- Who approves the requested access
- Whether the person will use an organization-owned or personal device
- When temporary access should expire
Establish a Clear Access Approval Process
Consider a nonprofit bringing in a volunteer for a three-month fundraising campaign.
The development manager requests access to the campaign's shared documents and scheduling platform, identifies the assignment end date, and submits the request to the designated approver.
Once approved, the IT administrator creates the account with the appropriate permissions. When the campaign ends, the development manager confirms that access should be removed.
This straightforward process establishes who requested access, who approved it, and when it should end.
When the Account Is Created
Each person should receive an individual account whenever the application supports it.
Accounts should be configured with appropriate permissions and multi-factor authentication (MFA), which requires an additional verification step during sign-in.
The organization should document who approved access and which systems were assigned.
For nonprofits using Microsoft 365, licensing is another consideration. Different employees may need different applications and security capabilities.
Our article on Microsoft 365 for nonprofits explains how organizations can evaluate available plans and assign licenses based on staff needs.
For Temporary Volunteers
A volunteer supporting a short-term project may need access only to specific documents and communication tools.
That access should have a defined purpose and an expected end date.
Giving temporary users unrestricted access creates unnecessary administrative work later and increases the possibility that permissions will remain active after their assignment ends.
Secure Shared Accounts, Personal Devices, and Cloud Files
Smaller nonprofits sometimes rely on shared passwords or personal devices because they appear convenient.
However, these practices can make it difficult to determine who accessed information, remove individual permissions, or protect organizational data when someone leaves.
Avoid Shared Login Credentials
Several volunteers using the same account may seem practical, especially for a shared scheduling or fundraising application.
The problem arises when a volunteer leaves. Changing the password may affect everyone, while leaving it unchanged could allow continued access.
Whenever possible, use individual accounts with permissions appropriate to each person's role.
If a system requires shared credentials, the organization should establish a controlled method for managing and updating them.
Establish Rules for Personal Devices
Volunteers and part-time employees may use personal laptops or smartphones to access nonprofit email, cloud documents, and scheduling platforms.
Organizations should decide which systems can be accessed from personal devices and what protections are required.
Important considerations include:
- Keeping operating systems and applications updated
- Requiring appropriate authentication
- Restricting downloads of confidential information
- Separating organizational accounts from personal accounts where practical
- Establishing procedures for lost or stolen devices
Nonprofit volunteer data security also requires planning for what happens when an assignment ends.
If volunteers use personal devices, the organization should establish how system access will be removed and how organizational files will be handled after departure. Where supported, managed applications can help separate nonprofit information from personal content.
These procedures should protect organizational information without unnecessarily accessing a volunteer's personal files.
Review External File Sharing
Cloud platforms make it easy to share documents with volunteers and outside partners.
A shared link may remain accessible long after a project ends.
For confidential information, access should be limited to identified users whenever practical, and sharing permissions should be reviewed when projects conclude.
SECURE NETWORKS ITCYour Nonprofit Deserves Reliable IT Support
20 years of experience supporting San Diego organizations. Get unlimited IT support, proactive cybersecurity, and predictable monthly pricing from a Microsoft Certified Partner.
IT Support for San Diego Nonprofits
Local expertise. Long-term partnership.
Remove Access Promptly When Someone Leaves
Offboarding is one of the most important parts of nonprofit user access management.
When an employee resigns, a volunteer completes an assignment, or a contractor finishes a project, the organization should follow a defined process to remove access.
Without that process, former users may continue to access email, shared documents, fundraising platforms, or other organizational resources.
Nonprofit Employee and Volunteer Offboarding Checklist
| Action | What needs to happen |
|---|---|
| Disable organizational accounts | Prevent further sign-ins to email and other managed systems |
| Revoke active sessions | End existing authenticated sessions where supported |
| Remove application permissions | Revoke access to donor databases, scheduling tools, accounting platforms, and other services |
| Review shared files | Remove direct permissions and previously granted external access |
| Transfer important information | Preserve necessary emails, files, and documents according to organizational policies |
| Recover organizational equipment | Collect laptops, phones, access cards, and other assigned devices |
| Update shared credentials | Change credentials the departing person knew and could still use |
| Review third-party connections | Remove access to connected applications and vendor platforms where appropriate |
The timing of these actions matters.
For planned departures, the organization should coordinate account changes with the person's final working day. For higher-risk situations, access may need to be removed immediately.
Managers should notify whoever administers IT accounts as soon as a departure is confirmed.
Disable Accounts Before Considering Deletion
Disabling an account prevents the former user from signing in while allowing the organization to review associated information and preserve necessary records.
Deleting an account is a separate decision. Depending on the platform, deletion may affect retained email, shared files, application ownership, and licensing.
For example, a departing development director may own fundraising documents, shared calendars, or records that colleagues still need.
Before permanently deleting an account, the organization should determine which information must be retained, transfer ownership where necessary, and follow applicable retention requirements.
The same principle applies to volunteers who created project files or managed shared resources.
Review Employee and Volunteer Access Regularly
Access management should continue throughout a person's time with the organization.
An employee promoted from program coordinator to operations manager may need additional permissions. However, access from the previous role may no longer be appropriate.
Similarly, a volunteer who moves to a different project should not automatically retain access to information from an earlier assignment.
Maintain an Inventory of Accounts and Applications
A nonprofit cannot reliably review user access without knowing which systems people use.
Maintain a current inventory of organizational applications, account owners, and authorized users.
Include:
- Email and cloud storage platforms
- Fundraising and donor management systems
- Accounting and payment applications
- Separating organizational accounts from personal accounts where practical
- Other applications used for nonprofit operations
This inventory does not need to be complicated. It should identify who is responsible for each system and provide enough information to support onboarding, access reviews, and offboarding.
Avoid storing passwords directly in an ordinary spreadsheet or shared document.
A Practical Access Review for Nonprofit Leaders
At a frequency appropriate to the organization's staffing changes and risk, ask the responsible manager or IT administrator to review:
- Active users: Does every account belong to someone currently authorized?
- Permissions: Does each person still need the systems and files they can access?
- Administrator accounts: Are elevated privileges limited to approved personnel?
- External access: Do former contractors and volunteers still have permissions?
- Temporary accounts: Have assignments ended without access being removed?
- Shared resources: Are cloud folders and documents accessible only to the intended people?
Organizations with frequent volunteer turnover may need more frequent reviews than those with a stable employee roster.
Document identified problems, assign responsibility, and confirm when corrections are completed.
User access is one part of an organization's broader security responsibilities. Our Nonprofit Cybersecurity Checklist for Executive Directors covers additional protections involving email, devices, backups, and incident response.
Who Should Be Responsible for Nonprofit Access Management?
Access management requires coordination between organizational leadership and whoever administers IT systems.
The responsibilities should be clearly assigned.
Executive directors and department managers determine which people need access based on their roles. They should also communicate staffing changes promptly.
Operations or administrative staff may coordinate onboarding requests, maintain account records, and track employee or volunteer departures.
Internal IT personnel or a managed IT provider create and configure accounts, apply security settings, manage permissions, and disable access when authorized.
This separation is important. IT personnel should not have to guess which donor records a volunteer needs, while program managers should not be expected to configure complex security settings.
For smaller nonprofits, the process can be straightforward. A designated manager approves access, a responsible IT contact implements it, and both confirm completion.
Clear procedures help maintain consistent access management, even when the organization has limited administrative resources.
How Secure Networks ITC Helps Nonprofits Manage User Access
Secure Networks ITC has 20 years of experience supporting organizations throughout San Diego County. As a Microsoft Certified Partner, we help nonprofits manage employee accounts, cloud services, cybersecurity, and everyday IT operations.
Our managed IT services for nonprofits support consistent onboarding, permission changes, and account removal as organizational needs change.
With unlimited IT support and predictable flat per-seat monthly pricing, nonprofit leaders have an established technology partner to help manage access and reduce avoidable security risks.
More Resources for Nonprofits
Explore practical guidance on securing organizational accounts, protecting donor information, and managing the technology your employees and volunteers use.
