The IT Offboarding Checklist: Closing the Door When Someone Leaves

Organizations put a lot of care into welcoming new employees and much less into the day someone leaves. Yet offboarding is one of the most common sources of security gaps. Former staff who still have access to email, files or business systems create risk long after their last day, whether or not anyone intends harm.

Start before the last day

Good offboarding begins as soon as a departure is known. HR, the employee’s manager and IT should agree on the timeline and on any special circumstances. For a sensitive or involuntary departure, access should be removed at the moment the conversation happens, not at the end of the day.

The core checklist

Access

• Disable the user’s main account and sign them out of all active sessions.
• Reset or remove multi-factor authentication methods tied to their personal phone.
• Remove access to business applications that don’t use single sign-on, such as finance, payroll, donor or patient systems.
• Change any shared passwords they knew, and move them into a password manager if they aren’t already.
• Revoke VPN, remote access and building access.

Data

• Convert the mailbox to a shared mailbox or delegate it to their manager, so incoming messages aren’t lost.
• Move important files from their OneDrive to a shared location.
• Transfer ownership of shared files, Teams, groups and automated workflows they created.
• Apply your retention policy so records are kept as long as required.

Devices

• Collect laptops, phones, security keys and badges.
• Remove organizational data from personal phones that were used for work.
• Wipe and reissue returned devices, or retire them securely.

Licenses and vendors

• Reclaim software licenses so you stop paying for them.
• Update vendor contacts, bank signers and domain or account ownership if the person was listed.

Watch out for the hidden accounts

The hardest access to remove is the access nobody wrote down: a vendor portal, a social media account, a free tool a team adopted. Keeping an up-to-date list of the systems each role uses makes offboarding faster and far more complete.

Automate what you can

Much of this checklist can be automated. When HR marks an employee as departing, an automated workflow can create the IT tasks, notify the manager and set reminders. Single sign-on also helps, because disabling one account removes access to every connected application at once.

The bottom line

A written, repeatable offboarding process protects your data, saves money on unused licenses and avoids awkward discoveries months later. Treat every departure with the same care as every arrival.

Want a reliable offboarding process? See our managed IT services.