Employee Offboarding IT Checklist
When an employee leaves, their access should leave with them, on their last day, not three months later when someone notices. Former employees with lingering access are a common cause of data leaks, and forgotten licenses quietly waste money. Use this checklist every time.
Before the last day
- Agree on timing with HR or the owner. For a sensitive or involuntary departure, access should be removed at the moment the person is told, not after.
- Identify everything the person has access to. Email, file shares, line-of-business applications, banking, payroll, vendor portals, social media, the domain registrar, building access, and any shared passwords they know.
- Find out where their work lives. Files on their desktop or in a personal OneDrive should be moved to shared storage.
- Plan email handling. Who will monitor their mailbox, and for how long?
- Arrange equipment return: laptop, phone, tablet, keys, badges, security keys.
On the last day
- Block sign-in to Microsoft 365 or Google Workspace. (Blocking is reversible. Deleting immediately is not.)
- Sign them out of all sessions and revoke tokens. Phones and browsers can otherwise stay logged in.
- Reset their password and remove their MFA methods.
- Remove them from groups, shared mailboxes, and Teams or SharePoint sites with external access.
- Disable access to other systems: accounting, CRM, EHR or practice management, payroll, VPN, remote access tools, and anything using its own login.
- Remove them as an admin or owner of any account: social media, Google Business Profile, domain registrar, website, ad accounts.
- Change shared passwords they knew, including Wi-Fi if appropriate.
- Wipe or retire company data on personal phones using your mobile device management.
- Collect equipment.
- Disable building access.
In the following days
- Set up email handling. In Microsoft 365, converting the mailbox to a shared mailbox keeps the email accessible to a manager and doesn’t require a license (for mailboxes under 50 GB). In Google Workspace, delegate access or transfer data before deleting the account.
- Set an automatic reply pointing contacts to the right person, if appropriate.
- Transfer file ownership. Move their OneDrive or Google Drive files to a manager or shared location.
- Check for forwarding rules or connected apps they set up.
- Remove or reassign licenses so you stop paying for them.
- Wipe and reimage returned computers before giving them to someone else.
- Update documentation: contact lists, vendor contacts, and who’s responsible for what.
Accounts people forget
These are the ones that cause trouble later:
- Vendor and supplier portals
- Banking and payment platforms where they were an authorized user
- Social media and ad accounts
- Domain registrar and DNS
- Industry-specific systems (load boards, court e-filing, tax software, EHR)
- Personal devices with company email still syncing
- Shared password manager vaults
Make onboarding feed offboarding
The easiest way to offboard completely is to track access as you grant it. Keep a simple list for each employee of the accounts and equipment they receive when they start. On their last day, work through the list in reverse.
Seasonal staff, contractors, and volunteers
The same steps apply. For seasonal staff, such as tax-season preparers, set an end date on their accounts when you create them. See our guides for accounting and tax firms and nonprofits.
Questions about this guide, or something we got wrong? Email info@virginiaitguide.com.