The Day an Employee Leaves: The IT Offboarding Checklist Most Businesses Skip
December 22nd, 2026
The last day of work usually follows a familiar pattern. HR runs an exit checklist, the manager collects a laptop, and someone sends IT a message at 4:30 in the afternoon asking for the email account to be disabled. By 5:00 the employee is gone. The account is off. The rest of the access is still on.
That gap is where offboarding fails. A departing employee may hold credentials for file shares, cloud applications, the phone system, the copier address book, vendor portals, shared mailboxes, and a local administrator account nobody documented. Disabling the email account closes one door in a building with many.
The risk is not only the employee who leaves angry. A friendly departure can still create exposure: a personal device that keeps syncing, a phone that still receives work calls, a shared password that never changed, a cloud storage link that remains public. The longer those stay open, the higher the chance that someone else uses them.
Why Offboarding Gets Skipped
Most businesses do not ignore offboarding on purpose. They lack a process that survives a busy week.
- No single owner. HR owns the paperwork, IT owns the accounts, the manager owns the work, and facilities owns the badge. Nobody owns the whole list.
- No access inventory. If nobody knows every system the employee can reach, nobody can revoke all of it.
- Fear of losing data. Managers delay disabling accounts because they worry about missing files or emails. The account stays active long after the person leaves.
- Contractors and temps. Non-employees often get accounts through a different path and never appear on the HR list.
- Role changes. An internal transfer is an offboarding event for the old role. Most organizations treat it as a new onboarding only.
- Shared credentials. When a team shares one login, disabling a person does not remove access. The password has to change, and often does not.
Before the Last Day: Build the List
Offboarding starts before the final week. The first task is an access inventory, built with the employee and the manager while everyone is still available.
Accounts and identities
- Directory account and single sign-on profile
- Email, calendar, and shared mailboxes
- File shares and cloud storage
- Line-of-business applications: CRM, ERP, accounting, HR, ticketing, project management
- Remote access: VPN, remote desktop, virtual desktop
- Administrative consoles for servers, network equipment, backup, and security tools
- Vendor portals and supplier websites
- Social media, website, and domain registrar accounts
- Password manager and any shared credential store
- API keys, service accounts, and integration credentials the person created or used
Ask specifically about accounts created with a company credit card or a personal email address. Those are the ones that never appear in a formal inventory.
Devices and physical access
- Laptop, desktop, tablet, and phone
- Security keys, authenticator apps, and SMS numbers used for multi-factor authentication
- Building badge, parking pass, desk key, and cabinet key
- Company vehicle, fuel card, and credit card if applicable
- Print release code and copier access
- Voicemail PIN and phone extension
Work and data handover
Confirm who receives the employee's active files, open projects, vendor contacts, and recurring reports. Transfer ownership rather than copying files to a shared drive and leaving duplicates. Check personal cloud storage for work documents and external sharing links the employee created. If a legal hold or investigation is possible, involve counsel before deleting anything.
On the Last Day: Disable, Do Not Delete
The safest default is to disable accounts and preserve the data. Deletion destroys the audit trail and can violate retention requirements. A disabled account can be re-enabled if the person returns, and its mailbox and files can be transferred under policy.
Work through this list on the final day:
- Disable the directory account. This should cascade to email, single sign-on, and connected applications where possible.
- Revoke active sessions and tokens. Disabling an account does not always sign the person out of every application. Revoke sessions, refresh tokens, OAuth grants, and app-specific passwords.
- Remove multi-factor authentication devices. Remove the person's phone number, authenticator registration, and security keys from the account.
- Change shared passwords. Any password the employee knew should be rotated, especially local administrator accounts, service accounts, and vendor portals.
- Rotate API keys and integration secrets. Search for keys created by the employee or stored where the employee had access.
- Handle the mailbox. Set an auto-reply if appropriate, delegate to the manager or a successor, and define how long the mailbox stays active under the retention policy. Do not forward mail to a personal address.
- Transfer file ownership. Move ownership of documents, shared drives, distribution lists, calendars, and project workspaces. Remove the employee from groups that grant access.
- Revoke remote access. Remove VPN profiles, remote desktop permissions, and any personal device enrolled in management.
- Recover and wipe devices. Collect company equipment, remove management enrollment, and wipe or reimage before reuse. Confirm that local data is destroyed.
- Close the phone and voicemail. Remove the extension, change the voicemail PIN, update call routing, and check whether the phone forwards to a personal number.
- Remove physical access. Deactivate the badge, change door codes, collect keys, and remove the person from the alarm or access control system.
- Remove print access. Delete the print release code, remove the person from scan-to-email profiles, and check the copier address book for a personal address.
- Update vendor and bank contacts. Remove the employee as an authorized contact for utilities, software vendors, banks, and service providers.
- Document what was done. Record each action, the person who performed it, and the time. The record is useful for audits and for the next offboarding.
After the Last Day: Watch and Close Out
Offboarding does not end when the account is disabled. The first 30 days are when problems show up.
- Review access logs. Look for login attempts, unusual file access, mailbox rules, forwarding settings, and new device enrollments.
- Check for shadow accounts. Search the identity provider and application list for accounts that were created outside the normal process.
- Retain data per policy. Keep the mailbox and files for the required period, then delete them on a documented schedule.
- Reimage devices. Do not hand a departed employee's laptop to a new hire without a full wipe.
- Update the org chart and contact lists. Remove the person from the website, voicemail greetings, email groups, and vendor records.
- Review remaining access. The departure is a good time to check whether the rest of the team has permissions they no longer need.
Where Businesses Usually Miss Access
The standard checklist covers email and the laptop. These are the items that tend to survive:
- Local administrator accounts. A separate admin login on a laptop or server often stays active after the domain account is disabled.
- Service accounts. A person who set up a backup job, integration, or scheduled task may know the service account password. Rotate it.
- Shared mailboxes and distribution lists. Access is often granted to a group, and nobody removes the individual from the group.
- Phone forwarding. A desk phone or softphone may still forward calls to a personal mobile number.
- Copier and scanner profiles. Scan-to-email and address book entries can preserve access to a personal inbox long after the employee leaves.
- Cloud applications bought with a corporate card. These often sit outside single sign-on and outside the official application list.
- Domain and website accounts. Registrar, DNS, SSL, and social media credentials are frequently held by one person and never documented.
- Physical access. Door codes, alarm codes, filing cabinet keys, and storage unit keys are easy to forget.
- Contractors and seasonal staff. They may not appear on the HR termination list at all.
Build a Repeatable Process
A checklist is better than nothing. A process that runs without reminders is better than a checklist.
Start with a single offboarding ticket template that lists every system, device, and access type. Tie the ticket to the HR termination event so it cannot be missed. Keep an asset register that links people to devices and applications. Use single sign-on and a directory as the primary access path, so disabling one account removes access to most applications. Use mobile device management so a company phone or laptop can be wiped remotely. Automate what can be automated, and assign a named owner for the rest.
Then review the process twice a year. Run a tabletop exercise: pick a departed employee, pull the records, and confirm every account is disabled and every device is accounted for. Most organizations find at least one gap the first time they try it.
This work sits inside a broader security program. Managed IT services can maintain the identity, device, and access inventory that makes offboarding reliable. A network security review can show which accounts and devices still have access after a departure. And your IT support team should have a clear path to act on an offboarding ticket the same day, not when someone gets around to it.
If badge access, door codes, and physical keys are part of the picture, connect the offboarding list to your physical security system as well. An employee who cannot log in but can still open the server room door is not fully offboarded.
Offboarding is one of the few security controls that is entirely within your control. The accounts are yours. The devices are yours. The access list is yours. The only question is whether anyone owns the whole list. If you want a second set of eyes on your process, start a conversation with our team.
Posted in: Managed IT Services, Cybersecurity