The Day an Employee Leaves: The IT Offboarding Checklist Most Businesses Skip

December 15th, 2026

On an employee's last day, the visible tasks get done. The badge comes back, the laptop is collected, someone sends a goodbye email, and the team goes to lunch. What often survives the departure is the part nobody can see: the account that still signs in, the password that was never changed, the personal phone that still receives the company's multifactor codes, and the email rule that quietly forwards everything to an outside address.

Offboarding gets a fraction of the attention that onboarding receives, and the asymmetry is expensive. A new hire needs access to do the job. A former employee needs every one of those accesses removed, plus the ones created after the original checklist was written. At a small company, the person who knows where all the accounts live may be the person who is leaving.

Why the Last Day Is a Security Event

Most departing employees leave on good terms and never touch a system again. The risk is not only the angry insider. It is the account that sits unused for months, the shared password that was written on a note, the vendor portal that was registered with a personal email address, and the laptop that gets resold or handed to a new employee without a wipe. Each one is a door that stays unlocked after the person is gone.

There is also a compliance dimension. Health information, financial records, and personal data all carry rules about who may access them. An active account belonging to a former employee is difficult to explain during a breach investigation, an audit, or a cyber insurance review. Insurers now ask about joiner, mover, and leaver processes, and "we disable the account when HR tells us" is a weak answer if nobody can prove when that happened.

The fix is not complicated. It is a checklist with a named owner, a trigger, and a record. The checklist below is written for a typical small or mid-sized business, and it is longer than most because the gaps are usually in the details.

Before the Last Day

Planned departures give the business time to do this properly. Start as soon as the resignation or retirement date is known, and involve the manager, HR, and IT in the same conversation.

• Inventory the accounts. Pull a list from the identity provider and from every business application the company uses. Include email, file storage, the phone system, the CRM, accounting, payroll, the line-of-business application, remote access, the password manager, and any vendor portal tied to the person's work email.
• Transfer ownership of data. Files in personal OneDrive or Google Drive folders, shared mailboxes, distribution lists, scheduled reports, and spreadsheets that only the departing employee knows about. Decide what moves to the manager, what moves to a shared location, and what can be archived.
• Document the knowledge. Passwords for shared tools belong in the password manager, not in a notebook. Vendor contacts, renewal dates, and the informal processes the person runs should be written down while the person is still available to explain them.
• Plan the mailbox. Decide whether email will be forwarded temporarily, delegated to a manager, converted to a shared mailbox, or archived. Do not leave the decision to the last hour.
• Plan the devices. Company laptop, phone, tablet, monitor, headset, keys, and any gear at a home office. For remote employees, arrange shipping and a return date in advance.
• Check for legal holds or retention requirements. If the departure involves a dispute, an investigation, or a regulated record, preserve the mailbox and files instead of deleting them.

The Last Hour

The order matters. Revoke access before the person walks out of the building, and do it in one coordinated session so nothing is missed between systems.

• Disable the account, do not delete it. Disabling blocks sign-in while preserving the mailbox, files, and audit trail. Deletion is a later decision, after retention requirements are satisfied.
• Revoke active sessions and tokens. A password change does not sign out an existing session. Revoke sessions in the identity provider, remove registered devices, and revoke OAuth tokens and app passwords. Otherwise a phone or laptop that is still logged in keeps working.
• Reset the password and remove MFA methods. Reset the password to a random value, remove the employee's authenticator registrations and phone number, and clear any recovery email or security questions that point to a personal address.
• Remove group memberships. Email distribution lists, security groups, shared drive permissions, Teams or Slack channels, and any role that grants access to another system.
• Close remote access. VPN accounts, remote desktop access, and any remote support tool the employee used.
• Handle the phone system. Remove the extension or softphone account, clear voicemail, remove the mobile app, and check whether calls were forwarded to a personal number. A company phone number that still rings on a former employee's cell phone is a common oversight.
• Collect physical access. Badge, keys, parking pass, alarm code, mailbox key, and any access card for a server room or storage unit. If a code was shared, change it.

The First 24 Hours

• Audit the mailbox. Look for forwarding rules, auto-replies, delegated access, and rules that move or delete messages. Rules created before departure can quietly send company mail to an outside address.
• Convert or archive the mailbox. A shared mailbox lets a manager see incoming mail while preserving the record. Export the mailbox if retention policy calls for it, and store the archive in a controlled location.
• Transfer file ownership. OneDrive, Google Drive, SharePoint, and any local folders on the returned laptop. Check for files stored outside the company's managed storage.
• Reassign licenses. Remove the departing employee from paid seats that will not be used, and reassign the ones that will. Keep the license active if the mailbox must remain available as a shared mailbox, depending on the platform.
• Remove the account from third-party services. This is the long tail: project management tools, e-signature services, shipping portals, marketing platforms, industry databases, and any free service that was signed up for with the work email. Each one is an account the company may not remember owning.
• Review the password manager. Remove the employee from shared vaults, rotate every shared credential the person could see, and check for credentials stored in the personal vault that were never shared.
• Handle devices. Wipe or reimage the returned laptop before it is reused. For a personal phone that accessed company email, remove the company profile and data through mobile device management. Do not wipe a personal device. Get a record of the wipe for company equipment.

The First Week

• Review recent activity. Check sign-in logs, file downloads, email forwarding rules, and access to sensitive folders during the final weeks of employment. Most of this is routine, but the review is easier now than after a problem appears.
• Rotate shared secrets. Any password, API key, or access token the employee could have seen should be changed. This includes the Wi-Fi password if it was shared with visitors, the alarm code, and any shared account that was used by the team.
• Check the phone system and call routing. Confirm that the main number no longer routes to the former employee, and update the auto-attendant or directory if the person was listed.
• Update the org chart and directory. Remove the person from the website team page, the email directory, and any internal contact list that customers use.
• Close vendor and financial access. Purchasing cards, expense systems, bank portals, and any account that can move money or approve spending deserve a separate check, ideally by finance rather than IT alone.

The Accounts Most Checklists Miss

These are the items that show up again and again when an offboarding review is done after the fact.

• Multifactor authentication devices. The employee's personal phone may still be the registered second factor for a shared account. Removing the account but leaving the phone registered can lock the company out or leave a way back in.
• Browser-saved passwords. A returned laptop may contain saved credentials for personal and company sites. Reimage the device rather than trusting the browser profile to be cleared.
• Email forwarding rules. A rule can forward copies of invoices, contracts, and customer messages without changing the password or leaving an obvious trace in the inbox. Audit the rules as part of every departure.
• Shared accounts. If several people used one login, disabling the employee's named account does nothing. The shared password has to be rotated, and the shared account should be replaced with named accounts wherever possible.
• API keys and service accounts. A developer or IT administrator may have created keys for integrations, scripts, or monitoring. These credentials often outlive the person and are rarely documented.
• Personal cloud accounts used for work. Files synced to a personal Dropbox, Google Drive, or iCloud account leave the company's control. Check for sync clients on the returned device and remind the employee of the obligation to return company data.
• Social media and domain accounts. Access to the company's social profiles, domain registrar, DNS, website admin, and review sites should be removed and the passwords changed.
• The mailbox as a knowledge base. When a salesperson leaves, years of customer history can live only in their inbox. Convert it to a shared mailbox or export it, and make sure the manager knows how to search it.

Involuntary Departures Need a Different Sequence

When the departure is a termination, the sequence changes. Access should be revoked before the conversation, coordinated in advance with HR and the manager so the employee does not learn the decision from a locked screen. For an employee working remotely, disable remote access and remote wipe company devices at the agreed time. Preserve the mailbox and files if there is any chance of a legal claim, and involve counsel before deleting anything. The technical steps are the same checklist, executed in a different order and with more documentation.

Who Owns Offboarding

Offboarding fails when it belongs to everyone. A workable model assigns three roles. HR triggers the process and confirms the last day. The manager owns knowledge transfer and decides where the work goes. IT executes the account, device, and access steps and keeps the record. At a company without an internal IT team, the managed service provider should hold the runbook and receive the trigger directly from HR, not through a hallway conversation.

The record is part of the job. For each departure, note who disabled the account, when it happened, which systems were checked, when devices were returned and wiped, and who approved the mailbox disposition. That record answers an auditor, an insurer, or a lawyer without a scramble, and it makes the next offboarding faster.

Bottom Line

Most offboarding problems are not technical. They are ownership problems: an account nobody remembered, a password nobody rotated, a phone number nobody checked. A written checklist with a named owner, a clear trigger from HR, and a short record of what was done closes the gap. The companies that handle this well treat the departure as a project with a start time, an end time, and proof.

TOTLCOM helps businesses across Northern California manage managed IT services, including joiner and leaver processes, access reviews, and the documentation that supports audits and insurance renewals. For more on the risks a former employee can leave behind, read why employees are your largest cybersecurity risk and our advice on sharing critical passwords. Our managed IT services articles cover the rest of the operational basics, and if your offboarding process is still a verbal handoff, contact us to build a repeatable checklist.

Posted in: Managed IT Services