Employee IT Offboarding Checklist: What to Do When Someone Leaves

Why employee offboarding needs an IT plan

Imagine an employee leaves on Friday. Their laptop is back on the desk, but they still know the shared office Wi-Fi password, can sign in to a vendor portal from home, and own the OneDrive folder containing an active customer project. On Monday, someone needs an email attachment that only exists in the former employee’s mailbox.

Nothing about that situation requires a sophisticated cyberattack. It is what happens when the business treats IT offboarding as a device-return task instead of an access-and-information handoff. The goal is simple: stop access at the right time, keep the records the business needs, and give ongoing work a new owner.

Not every business has a dedicated IT department. A one-page checklist, a responsible person, and a clear departure time can prevent the most common mistakes.

1. Coordinate the departure and identify what the employee used

Have the business owner or HR contact tell the person handling IT when access must end. For a planned departure, you can prepare the checklist before the final day. For an unexpected or involuntary departure, the access cutoff may need to be coordinated with the meeting itself. Avoid disabling accounts early without authorization; that can interrupt work and tip off the employee.

Start with an inventory. Look beyond the employee’s computer and email:

• Microsoft 365 or Google Workspace account, business email, Teams, and cloud files
• Windows or Mac sign-in, network shares, VPN, remote desktop, and remote-support tools
• Accounting, payroll, CRM, scheduling, industry-specific, and vendor systems
• Company social media, website administration, domain registrar, and marketing services
• Password managers, authenticator apps, security keys, shared credentials, and API keys
• Business-owned laptops, phones, tablets, removable storage, access cards, and keys

Record who owns each system and who will take over. If nobody knows what the person could access, a quick inventory is a higher priority than immediately deleting the account.

2. Block sign-in and end existing sessions

At the authorized cutoff time, disable the employee’s business account and revoke active sessions where supported. For Microsoft 365, an administrator can block sign-in and use the sign-out or session-revocation controls. Resetting the account password is also part of Microsoft’s former-employee guidance, but a password reset alone is not a complete offboarding procedure.

Some apps maintain their own sessions, and existing access tokens can remain valid briefly. A Microsoft 365 sign-out does not automatically terminate every third-party application session. Review applications that allow direct sign-in, especially financial, payroll, CRM, website, and remote-access systems.

If the business uses an on-premises Active Directory domain synchronized to Microsoft 365, the account may need to be disabled in the on-premises directory rather than managed as a cloud-only account. Coordinate that with whoever administers the environment.

Practical check: Confirm the account cannot start a fresh sign-in to the core business services. Document any systems that require manual deactivation by a vendor.

3. Keep business email available without keeping the employee active

Decide who is responsible for messages that arrive at the employee’s address after the departure. Customer inquiries, open quotes, invoices, and meeting invitations may still reach that mailbox.

In Microsoft 365, two common approaches are:

• Convert the mailbox to a shared mailbox: Authorized staff can access existing email and calendar items, and the address can continue receiving messages. Follow Microsoft’s conversion and permissions process.
• Set up email forwarding: New messages can go to a designated colleague. Forwarding alone does not transfer the history of an existing mailbox.

Microsoft cautions not to delete the underlying user account if it anchors a shared mailbox or forwarding setup. A shared mailbox usually does not need its own license when it remains within the standard 50 GB limit, but larger mailboxes and certain archival or legal-hold features can require licensing. Plan the mailbox transition before removing the license.

Also review recurring meetings, shared calendars, approval workflows, and automatic replies. A neutral reply such as “Please contact our main office for assistance” can help customers reach the right person without revealing unnecessary employment details.

4. Transfer files and ownership before deleting anything

Business documents might live in OneDrive, SharePoint, Teams, local folders, network shares, or applications the employee managed. Identify current projects first: open proposals, customer records, recurring reports, accounting exports, saved procedures, and files linked from other systems.

For Microsoft 365, arrange access to needed OneDrive content and move durable team documents into an appropriate shared location, such as a controlled SharePoint library. Don't simply copy everything into another person's personal folder and assume the problem is solved.

Time matters. Microsoft states that when a user is deleted, OneDrive retention is 30 days by default, although organizations can configure different retention behavior and legal holds may apply. Removing a license and deleting an account also have different consequences. Never count on an undocumented recovery period.

Review any legal, privacy, or contractual requirements before handing over a former employee’s email or files. The business should approve who may see that information and how long it must be retained.

5. Collect equipment and secure company data on devices

Use an equipment checklist instead of relying on memory: laptop, charging cable, mobile phone, tablet, USB drives, security keys, and any issued network or physical-access equipment. Record the asset identifiers and condition, then check for company data stored locally.

On managed company devices, IT may be able to lock, retire, or wipe a device. These actions are not interchangeable. Do not factory-reset a laptop until business files, recovery keys, and any required records have been preserved. If a personal phone was used for business email, use the management option appropriate to the setup; an account-only or selective wipe may be preferable to erasing personal data.

Where a device cannot be recovered immediately, prioritize disabling account access, reviewing its management status, and following the company’s lost-device procedure.

6. Rotate shared passwords and review privileged access

Disabling one person's login does not invalidate passwords that several employees know. Determine whether the departing employee had access to a shared password manager vault, Wi-Fi network, alarm system, vendor portal, administrative account, or service credential.

• Change shared passwords and revoke shared session tokens when the person knew or could retrieve them.
• Remove their access to password-manager collections, MFA methods, recovery codes, and privileged groups.
• Review third-party OAuth app connections, automation accounts, API keys, SSH keys, and remote-access credentials.
• Transfer ownership of website, cloud, billing, and domain accounts to a company-controlled administrator.

Not every password must be changed automatically. Prioritize credentials the employee actually had access to, and avoid rotating service passwords without understanding the systems they might interrupt. Long-term, named accounts and limited permissions make offboarding far easier than shared administrator logins.

7. Clean up licenses, subscriptions, and vendor contacts

Once email and file preservation is complete, review the departing employee’s assigned licenses and paid subscriptions. Some seats can be reassigned; some are tied to contracts or minimum commitments. Removing a license from a user does not necessarily cancel the organization’s paid subscription.

Update contacts at accounting vendors, internet providers, software support teams, managed service providers, and equipment suppliers. If the employee was the only approver or owner of a system, assign a replacement before removing their access.

The business should retain a record of the decision: what was removed, what was transferred, any ongoing costs, and who approved the changes.

A practical small-business IT offboarding checklist

This is a starting point for an internal checklist. Adjust it for your business and its obligations.

When	Action	Responsible party
Before departure	Confirm cutoff time, systems used, data owners, and equipment	Business owner / HR + IT
At authorized cutoff	Block core sign-ins, revoke sessions, disable VPN and third-party access	IT / service owners
Same day	Secure mailbox handoff and preserve needed business files	Manager + IT
Same day	Recover devices and revoke shared credentials with known exposure	Manager + IT
Following days	Transfer ownership of applications, meetings, and vendor accounts	Department owners
After preservation review	Adjust licenses and document the final disposition of accounts	IT + billing owner

Do not assume every task belongs to IT. Human resources determines departure timing and policy; management decides who needs access to business records; IT carries out and documents the technical changes.

The final step: verify and document

Before calling the process finished, ask: Can the former employee still sign in anywhere? Are important customer emails reaching someone? Can the replacement staff find needed files? Is the business still paying for services nobody uses?

A small IT offboarding record should include the departure date, authorized cutoff time, accounts disabled, devices recovered, business information transferred, shared credentials addressed, and unresolved exceptions. That record is useful even if the business hires only a few people a year.

Bottom line: Successful employee IT offboarding protects access and continuity. Ericson IT helps small businesses in Stillwater and the St. Croix Valley document accounts, secure Microsoft 365, manage devices, and establish repeatable procedures without unnecessary complexity.