An employee offboarding IT access checklist helps a business close access gaps without losing important records or disrupting daily work. A departure can involve far more than disabling an email account: there may be cloud files, business applications, remote access tools, shared credentials, devices, and physical entry credentials to address.
Plan the work with HR, IT, the employee’s manager, and facilities, and agree on when access should end. For an unplanned or higher-risk departure, coordinate the cutoff with the appropriate internal decision-makers and security staff. For any departure, use a documented process that protects company information while preserving records the business needs.
Before the employee’s last day
Start with a list of the person’s accounts, devices, permissions, and responsibilities. Ask the manager and relevant system owners to check for access that may not appear in a central account directory, such as vendor portals, shared mailboxes, production systems, or equipment management tools.
- HR: Confirm the departure date and the agreed access cutoff time with IT and the manager.
- Manager: Identify business records, active projects, recurring tasks, and accounts that need a new owner.
- IT or security: Inventory accounts, authentication methods, devices, remote connections, and privileged permissions.
- Facilities: Identify keys, badges, entry codes, and access to restricted areas or equipment.
Use your organization’s established policies and any applicable sector-specific process. CISA’s account security guidance and NIST’s security requirements for controlled information can help inform an organization’s review where relevant.
Employee offboarding IT access checklist
Identity, email, and cloud accounts
- Disable the employee’s primary identity-provider account at the agreed cutoff. Check connected sign-in methods and linked accounts, not just the company email address.
- Revoke active sessions and refresh tokens where the system supports it. Remove registered MFA devices, recovery phone numbers, backup email addresses, and other recovery methods associated with the employee.
- Review email, calendars, shared mailboxes, cloud storage, collaboration tools, and file-sharing services. Transfer ownership or delegate access to the appropriate person before removing the account or its license.
- Preserve business email, files, and records according to company policy and applicable retention requirements. Disabling access is not the same as deleting an account or its data.
Microsoft provides a former-employee account and data guide for organizations using its services. Confirm the steps for your own systems before removing licenses or deleting an account.
Business applications and elevated permissions
- Remove access to business applications such as finance, customer management, scheduling, HR, document management, and project tools.
- Check administrator roles and privileged accounts separately. Remove elevated permissions, administrator accounts, and access to infrastructure or security consoles that are no longer needed.
- Review vendor, partner, and customer portals. These accounts may be managed outside the company’s central sign-in system.
- For industrial or other operational technology, coordinate with the system owner so access is removed without disrupting critical processes.
Remote access and active connections
- Disable VPN, remote desktop, remote support, and other remote access tools assigned to the employee.
- Remove trusted devices and saved sign-ins where possible, and revoke sessions on company systems and third-party services.
- Check access to cloud administration consoles, network equipment, servers, and other systems reachable remotely.
For related steps on limiting exposure from a compromised account, see Zevonix’s guide on responding to a business email account compromise.
Shared passwords, keys, and tokens
Identify credentials the employee knew or could retrieve, including shared passwords, API keys, access tokens, SSH keys, service accounts, and credentials stored in password managers or scripts. Rotate or revoke them when needed, then update approved systems and document the change. Avoid simply changing a shared password without checking which people, integrations, or processes depend on it.
Review your broader access controls with Zevonix’s business IT security checklist as a companion resource.
Company devices and physical access
- Collect company laptops, phones, tablets, storage devices, keys, badges, and other assigned equipment. Record what was returned and what remains outstanding.
- Use the organization’s approved process to secure or reset devices, remove company access, and prepare equipment for reassignment. Take care to preserve business records before wiping or repurposing a device.
- Remove building badges, physical keys, alarm codes, and access to restricted rooms or equipment. Change shared entry codes if the employee knew them and your process calls for it.
- For company phones or other managed devices, review business accounts, authentication apps, and saved access before the device is reassigned or retired.
Preserve records and support the handoff
Keep the distinction between revoking access and deleting information clear. Before changing account ownership or removing licenses, identify the email, files, project records, and business communications that need to remain available. Assign a responsible owner and follow your organization’s retention and privacy procedures.
Document when access was removed, which systems were reviewed, what data or work was transferred, and any open items. If an account or credential cannot be disabled immediately, record the reason, the interim safeguard, and who will complete the follow-up. This creates a clear handoff and helps prevent overlooked access from lingering.
Healthcare organizations should include the appropriate privacy, security, and compliance contacts when an employee had access to electronic protected health information. Review the person’s access across relevant systems, document the actions taken, and follow the organization’s established procedures for protecting and retaining that information. Other regulated or specialized environments should likewise map their offboarding process to applicable requirements and internal policies.
Frequently asked questions
When should a former employee’s access be revoked?
Coordinate the cutoff with HR and the manager, then have IT disable access at the agreed time. For a higher-risk or involuntary departure, the organization may decide that access needs to end as part of the departure meeting. Follow your internal process and document the timing.
Should email and files be deleted when someone leaves?
Not automatically. First identify what business information must be retained and who needs to own or access it. Disable the former employee’s access while preserving records according to company policy and applicable requirements.
Should shared passwords, API keys, or access tokens be changed?
Review any credentials the employee could access. Revoke or rotate those that could still provide access, and check dependent systems and integrations before making changes so business processes continue to work.
What should happen to a former employee’s laptop or phone?
Recover and record company-owned devices, then secure them using the organization’s approved process. Preserve needed company data before resetting or reassigning a device, and remove associated accounts and authentication access.
Make offboarding a repeatable security process
A reliable offboarding process coordinates people, systems, records, and physical access. Keep the checklist current, assign clear owners, and confirm completion rather than assuming that disabling one account closes every path into the business. If you would like help reviewing your business’s access controls and IT processes, contact Zevonix at (904) 658-0777.