The only admin of a SaaS tool has left the company: what now?

Why is a missing admin an urgent problem?#

A missing admin is urgent because the admin is usually the only person who can export data, manage users, change billing and act on vendor notices. Without one, the company keeps paying for the tool but cannot fully control it.

The risk grows when the departed admin signed up with a personal email, put billing on a personal card, or left the vendor sending renewal and security notices to a mailbox nobody reads. A failed payment or a missed notice can lead to suspension, and suspension can switch off exports at exactly the wrong moment.

Ordinary users rarely notice the gap. Tickets still get answered and deals still get logged, so the problem surfaces only when someone needs a new user added, a report exported or a contract renewed.

First, check what the company already controls#

The fastest recovery uses access the company already holds. Work through these checks before contacting the vendor, because each one can spare a long exchange with vendor support.

• 1Identity provider: if the tool uses single sign-on through Microsoft Entra ID, Google Workspace or Okta, an identity admin may be able to grant the app's admin role or restore the departed user's company account under policy.
• 2Work email: if the admin signed up with a company address, IT can often restore that mailbox and use the tool's normal password reset, with written approval.
• 3Other roles: look for a billing owner, a secondary owner, or an admin on a related product under the same vendor account.
• 4Billing records: find invoices, the contract or order form, the paying entity and the payment method.
• 5Vendor contacts: find the account manager or customer success contact named in past emails.

Get written approval before touching a former employee's account#

Written approval from HR or legal comes before anyone opens a former employee's mailbox or account. Internal policy, employment terms and privacy rules may limit who can do it and for what purpose, so the sign-off should name the tool, the reason and the person doing the recovery.

Keep a short log of what was done and when: mailbox restored, password reset, admin role reassigned, mailbox closed again. Avoid reading unrelated mail. The log protects the company if the access is questioned later and doubles as evidence for the vendor if a formal recovery is still needed.

How does vendor ownership recovery work?#

Vendor ownership recovery is a support process in which the vendor checks that you represent the customer and then reassigns the owner or admin role. Most established SaaS vendors publish a procedure, though the steps and the proof they accept differ.

Send the request from a company address, include the account identifiers, and ask for written confirmation once ownership changes. Response times vary, so start at once rather than waiting until the renewal or an export deadline is close.

What if the account was set up on a personal email?#

A tool registered to a former employee's personal email is the hardest case, because the company cannot reset the password or receive the vendor's messages. Recovery then depends on payment records, the contract and the vendor's willingness to treat the company as the customer.

Ask the former employee first, politely and in writing, to add a company admin or transfer ownership. Many departures are friendly, and this is often the quickest path. If that fails, use the vendor's ownership process backed by invoices the company paid. Employment agreements and IP assignment terms may also help show the account belongs to the company, which counsel can confirm.

Illustrative: an HVAC contractor recovers its field service account#

Illustrative: a fictional HVAC contractor's office manager leaves after many years. Weeks later the team finds she was the only admin of the field service platform that holds every estimate, job, invoice and maintenance agreement. Technicians can still close jobs, but nobody can add a user, change the price book or export job history.

The platform does not use single sign-on, and her company mailbox was deleted rather than suspended when she left, so a password reset is not possible. The COO opens the vendor's ownership transfer process instead: the company adds the DNS record the vendor specifies, sends recent invoices paid from the company account and a letter signed by the president naming two new admins, and keeps the subscription paid while the request is reviewed.

Once ownership moves, the new admins export job history with notes and photos, move the billing contact to a shared finance inbox and record the tool in a system register. The same review finds several other tools with a single admin, and each is fixed before anyone else leaves.

How does a two-admin rule prevent the next lockout?#

A two-admin rule means every tool holding company records has at least two current employees with full admin rights, ideally from different teams. It usually costs little, at most an extra seat on some plans, and removes the single point of failure behind this kind of lockout.

The system register is the piece many companies lack. It turns offboarding from guesswork into a checklist, and it is the same list you need for renewals, audits and any review of which records the company holds.

• 1Two admins who are current employees on every important tool.
• 2Owner and admin roles tied to company email and, where offered, single sign-on.
• 3Billing on a company card or invoice, with a shared finance inbox as the billing contact.
• 4A system register listing each tool, its admins, billing owner, renewal date and export method.
• 5Admin access reviewed in every offboarding, before the departing person's last day.
• 6Multi-factor recovery methods held by the company, not only on a personal phone.
• 7Departing users' accounts suspended rather than deleted until their admin roles and files are moved, since deleted accounts may be recoverable only for a short time.

Where SourceX fits once access is back#

Recovering admin access is often when a company realizes it does not know what its tools hold. A SourceX fit check works from the same system register: system names, years of history and record families, with no files shared at that stage.

If a tool's records later move toward a license, the Approval step of the SourceX five-step transaction depends on knowing who can authorize release for the company, and the SourceX Evidence Packet records that release authorization. Clear admin ownership and clear signing authority are related problems, and fixing one tends to help with the other.