When an employee leaves your company, their access to business systems, applications, and sensitive data needs to be removed promptly. Overlooking even one account can create security risks, including unauthorized access and potential data breaches.
An employee offboarding checklist helps your HR and IT teams coordinate access removal, recover company equipment, and preserve important business information. Follow these steps to make sure nothing gets overlooked.
Agree on when access should end
As soon as an employee’s departure is confirmed, HR should notify your IT team or IT provider and establish exactly when the employee’s access will be revoked. For planned departures, schedule the cutoff for the employee’s final working day. For unexpected terminations, coordinate access removal with the termination meeting to prevent unauthorized access.
Make sure everyone understands their responsibilities. HR confirms the departure date and time, IT handles access removal, and the employee’s manager coordinates the handover of work and company equipment. Assign one person to oversee the checklist and confirm that all tasks are completed.
Before the cutoff, IT should compile a complete inventory of the employee’s accounts, applications, administrator privileges, and assigned devices. Work with their manager to identify any software or subscriptions that IT may not have on record.
Treat that inventory as part of your documented security procedures, so each departure follows an agreed process.
Block new sign-ins and close active sessions
At the agreed cutoff time, IT should disable the employee’s work accounts and remote network access to prevent further logins. Simply changing their password isn’t enough, as some applications may keep existing sessions active without requiring the employee to sign in again.
To fully revoke access, your IT team should:
- Block new sign-ins.
- Revoke active sessions where supported.
- Disable separate administrator accounts.
- Remove access to applications with independent logins.
Many businesses use single sign-on (SSO), which lets employees access several applications through one login. It simplifies account management, but disabling that login does not necessarily end every application’s existing session. IT may need to close sessions within individual applications too.
Have IT check authentication methods and recovery details associated with the departing employee, including a personal phone number used for account recovery.
Check access outside the main account
Disabling an employee’s main work account may not remove their access to every business system. Some applications, such as accounting software and vendor portals, use separate login credentials. Review the employee’s account inventory and disable any remaining access to these systems.
You should also change any shared passwords the employee previously used. Even after their individual account is disabled, they may still be able to access systems using shared credentials. Remove their access to company password vaults and update any shared passwords they knew.
Review delegated mailbox permissions and direct file-sharing access. If the employee manages software integrations or automated processes, IT should identify any access keys associated with their accounts. These keys allow applications to communicate with other services, so transfer essential connections to authorized accounts before revoking the old credentials to avoid disrupting business operations.
Recover equipment and remove company data
Use your equipment inventory to identify all company-owned devices and accessories the departing employee needs to return, including laptops, phones, security keys, and other assigned equipment. For remote employees, arrange tracked shipping and document which items have been returned or are still outstanding.
Before resetting or reassigning company devices, make sure any important business files have been backed up or transferred to the appropriate team members. If the employee used a personal device for work, IT should remove company accounts, applications, and managed data according to your organization’s device management policy without affecting personal information.
If you’re remotely wiping company data from a device, verify that the process was successful. Devices that are offline may not receive the removal command until they reconnect to the internet. Keep these tasks open on your offboarding checklist until IT confirms that company information has been removed.
Preserve information before deleting accounts
Disabling an employee’s account prevents further access, but permanently deleting it could also remove important business information. Before deleting any accounts, review what information needs to be retained and make arrangements to preserve it.
Transfer ownership of important documents, shared files, and ongoing projects to the appropriate employees. You should also determine how to handle incoming emails and customer inquiries. Depending on your email platform, converting the former employee’s mailbox into a shared mailbox may allow authorized staff to access previous correspondence and manage incoming messages without keeping the former employee’s login active.
You should also check your organization’s data retention policies and any applicable legal requirements, including litigation holds. Once you’ve confirmed that all necessary information has been preserved and is accessible, IT can proceed with account deletion and remove any licenses the business no longer needs.
For businesses using Microsoft 365, Microsoft’s employee removal guide explains how to preserve mailbox content, transfer access to files, and manage accounts when employees leave.
Verify completion before closing the checklist
IT should conduct a final review to confirm that the former employee can no longer access company systems or information. Check that all accounts have been disabled, active sessions have been terminated, and shared credentials have been updated where necessary. Review recent sign-in logs for any unexpected attempts to access company resources after the departure.
Document who completed each task and when it was finished. If any equipment returns or remote data removals are still pending, assign someone to follow up and set a clear deadline. Don’t mark these tasks as complete until you’ve verified the outcome.
Finally, update your IT inventory and offboarding procedures to address any gaps identified during the process. For example, if IT discovers an application or account that wasn’t previously documented, add it to your records so it won’t be overlooked during future employee departures.
A thorough employee offboarding process helps protect sensitive business information and prevent unauthorized access after an employee leaves. SpectrumWise can help your business review its offboarding procedures, identify potential security gaps, and strengthen access management. Contact us today to discuss your IT security needs.