IT Offboarding Checklist: What to Shut Off When Someone Leaves

Somewhere in most businesses there is an account that belongs to someone who left months ago, and it still works. Nobody decided to leave it open. The person walked out, HR finished the paperwork, and the IT side of the exit never made it onto anyone’s list.

An IT offboarding checklist closes that gap. The question behind it is easy to ask and surprisingly hard to answer completely: what do we shut off when someone leaves? The obvious answer is their login. The full answer also covers their email, files, devices, app accounts, shared passwords and a few things they set up years ago and have long forgotten.

Need the checklist? Jump to the interactive IT offboarding checklist below to track the important steps before, during and after an employee’s departure.

Decide the pace before you touch anything

Offboarding runs at two speeds. A planned resignation gives you a notice period to hand over files, redirect email and collect equipment. A sudden or contentious exit means access is cut at a set time, usually when the decision is communicated, and the cleanup follows.

Agree on the timing with HR before making changes. For a planned departure, arrange the handover while the employee is still working. For an unexpected exit, block access at the agreed time, then preserve and transfer the email, files and other business information they leave behind. Securing an account should not mean losing access to the work.

1. Cut sign-in, then end active sessions

Disabling the account stops new sign-ins, but it does not always end sessions that are already active. A phone or laptop may remain signed in for a period without asking for a password again. Revoke active sessions, reset credentials as appropriate, and remove the former employee’s authentication methods and recovery access.

In most cases, disable the account rather than deleting it immediately. Deletion can trigger recovery deadlines and data removal. In Microsoft 365, a deleted user can generally be restored during a limited recovery period, but that is a safety net, not an offboarding plan.

2. Secure email and files

A departed employee’s mailbox often holds client conversations, quotes and approvals that the business still needs. One common Microsoft 365 option is to convert the mailbox to a shared mailbox, which authorised colleagues can access without signing in as the former employee. Add an automatic reply pointing senders to the right contact, and arrange access to the employee’s OneDrive files before removing anything.

Check ownership too. If the person owned a Microsoft Teams team, a SharePoint site or a shared folder, assign another owner. If the business has records retention requirements or a legal hold, confirm these before deleting data or changing licences.

Microsoft 365 note: A converted shared mailbox still depends on its associated user account. Do not delete that account simply because the mailbox has been converted. Some shared mailboxes also need a licence, depending on mailbox size and features such as archiving or retention.

3. Collect or secure devices

Company laptops and phones should be returned, recorded in the asset register and securely wiped before reissue. For remote staff, arrange a tracked return rather than leaving collection to chance. If a device cannot be recovered immediately, take the appropriate remote security actions.

Personal devices need more care. When employees access work email through their own phones, remove company-managed data and access without unnecessarily erasing personal content. Tools such as Microsoft Intune may support selective removal, depending on device enrolment and app protection policies.

4. Work through apps, shared logins and admin rights

Single sign-on allows one identity to open many applications, so disabling that identity can cut off access to connected apps. However, separately managed accounts must still be checked: accounting platforms, marketing tools, supplier portals, design software, social media and website administration.

Rotate shared passwords and other credentials the employee knew or could access, prioritising those that still provide entry. If they were the sole owner or administrator of a system, such as a domain registrar or advertising account, transfer ownership before departure where possible. Regaining control after the only administrator has left is rarely straightforward.

5. Check the quiet access points

This is what separates thorough offboarding from a tidy-looking checklist. Access can persist in places that are easy to overlook:

• Mail forwarding rules that send messages to personal addresses
• Third-party app permissions allowing access to company email or files
• Automations that run under the employee’s identity
• Delegated access to other people’s mailboxes and calendars
• Remote access tools, VPN accounts, API keys and tokens
• Personal phone numbers used to receive verification codes for business accounts

Staff directories, email signatures, website team pages and customer-facing contact lists should also be updated so customers know who to contact.

6. Reclaim licences, then verify

Once business data is secured, check whether software licences can be removed or reassigned without affecting retention, shared mailboxes or other dependencies. Licences assigned to former staff can become an unnoticed recurring cost.

Finally, ask someone other than the person completing the offboarding to verify the result. Confirm that sign-in is blocked, privileged and third-party access is removed, devices are accounted for, and sign-in logs show no unexplained successful activity after the exit time. Investigate anything unexpected rather than assuming the checklist alone proves the account is secure.

Where offboarding usually breaks down

The technical steps are seldom what goes wrong. In our experience, the usual failure is that IT finds out late. The notification arrives as a farewell morning tea invitation, or after the person has already left, and access may remain open longer than it should.

The second pattern is accounts that IT never knew existed. Someone signs up for a design tool or a scheduling app with a work email and company card, and the service never appears on any list. An offboarding checklist is only as effective as the business’s understanding of where its accounts, applications and data are stored.

The third is the person who built things. A long-serving employee who created the automations, owns the supplier portals and holds the only admin login can present a bigger offboarding challenge than expected. Reviewing ownership well before someone leaves helps reduce that risk.

Offboarding should be triggered by an event, not someone’s memory. When HR records a departure date, an IT request should open with an owner, timing and agreed steps.

FAQ