A departing employee’s access can extend well beyond a company login. Email, cloud applications, vendor portals, saved credentials, active sessions, and physical access may all need attention. An employee offboarding IT checklist helps your team revoke access in an orderly way while keeping essential business information available to the people who need it.
Coordinate IT, the employee’s manager, and the appropriate HR contact so actions happen at the right time. The details will vary by role, systems, and company policy, but the sequence below provides a practical starting point.
Before the employee’s final day
Map access across systems and vendors
Start with an access inventory rather than relying only on your central directory or single sign-on service. Employees may have accounts created directly with applications or third parties, including accounts that are not visible in a central access system.
- List the employee’s email, directory, collaboration, file-sharing, and business application accounts.
- Include remote access, VPN, cloud platforms, administrative tools, and privileged accounts.
- Check vendor portals, payment or service platforms, and accounts used to manage outside providers.
- Look for integrations, API keys, automation credentials, and shared accounts the employee could access or manage.
- Identify authentication methods, including MFA devices, recovery options, security keys, and credentials saved on company or personal devices.
- Confirm whether the employee has access to offices, equipment rooms, or other areas through a badge, key, or access code.
Ask the manager which accounts and records are essential to ongoing work. Identify who will take ownership of business-critical files, inboxes, calendars, applications, and vendor relationships. If the departing employee was the only person with access to an account, arrange a secure handoff before access is removed.
Agree on timing and responsibilities
Decide who will carry out each action and when. Coordinate the revocation time with the people managing the departure, especially if access must remain available until a defined point. Avoid sharing passwords as a shortcut. Use approved account recovery or ownership-transfer processes instead.
For vendor access, contact the relevant account owner or provider as needed. CISA’s small-business vendor guidance asks businesses how they revoke access during offboarding, making vendor permissions an important part of the process: CISA’s vendor offboarding guidance.
At the separation event
Revoke the ability to sign in
At the agreed time, disable the employee’s access to the company identity account and connected systems. Include accounts that may not use single sign-on, such as direct application logins and vendor portals. Remove or change administrative privileges and remote access, and revoke access to shared resources the employee no longer needs.
Disabling an account is different from deleting it. In many cases, disabling preserves the account record and makes it possible to retain or transfer business information through an approved process. Follow your organization’s retention and access policies before deleting accounts or data. Keep the former employee from signing in while preserving records that the business needs.
End existing access, not just future sign-ins
Changing a password or disabling a primary account may not end every existing connection. Revoke active sessions where the service allows it, and review tokens, app passwords, remembered devices, recovery methods, and connected applications. Remove the employee’s MFA methods and update account recovery options so they no longer point to that person.
Rotate credentials for shared or service accounts if the employee knew them or could retrieve them. Review API keys, integrations, and other credentials the employee managed. Replace or revoke them through the system that issued them, then confirm that legitimate business processes still work. For broader identity and permission practices, see Zevonix’s article on managed identity and access management.
Secure company devices and physical access
Recover company laptops, phones, storage devices, badges, keys, and other assigned property. If a device cannot be returned immediately, use available management controls to restrict access and protect company data. For personal devices used for work, follow your organization’s established process for removing business access and data without disrupting unrelated personal information.
Disable badges and other physical credentials at the agreed time. Also check whether the person had access to shared workstations, equipment, or locations that require a separate permission change.
Transfer email, files, and business ownership
Make ownership changes deliberately. Identify the appropriate successor for business files, calendars, shared mailboxes, applications, and vendor accounts. Confirm that the new owner can reach what they need before removing the departing employee’s access to those resources.
- Redirect or delegate business communications using your approved process.
- Transfer ownership of work files and application records to an authorized person.
- Update vendor contacts, billing or administrative contacts, and account recovery details where appropriate.
- Move critical records out of personal folders or individually owned workspaces when policy allows.
- Review shared accounts and assign named, authorized access where the system supports it.
Keep the transfer separate from the access revocation: preserving information for the business does not require leaving the former employee able to sign in. When MFA settings or account recovery need to change during a handoff, Zevonix’s guide to business account multifactor authentication can help frame the questions to review.
After access is revoked
Verify each change
Do not treat a checklist item as complete just because a request was submitted. Confirm that accounts are disabled, sessions and credentials are revoked, vendor permissions are removed, ownership transfers are successful, and devices or physical credentials are recovered or secured. Check direct-to-application accounts and third-party services separately if they are not controlled from a central identity system.
For organizations handling regulated information, include the systems and records relevant to that work, and follow the organization’s established policies. Healthcare teams can include their HIPAA-related access and documentation steps in the process. Zevonix provides compliance support for HIPAA, PCI-DSS, SOX, and GDPR; its overview of cybersecurity and regulatory compliance offers related context.
Keep a completion record
Document the departure date or effective time, systems reviewed, access removed, credentials rotated, data or accounts transferred, equipment recovered, and any outstanding action. Record who completed or verified each step, using your organization’s approved recordkeeping process. Note exceptions, such as a vendor account awaiting provider action, and assign follow-up responsibility.
A clear record helps the business see what has been completed and what still needs attention. It also gives the team a repeatable process to improve when it finds missed accounts or unclear ownership.
When an employee changes roles
A role change is not always a full departure, but it still calls for an access review. Remove permissions the employee no longer needs, update group memberships and application roles, and transfer responsibility for accounts or records tied to the old role. Confirm that new access matches the employee’s current duties, rather than simply adding permissions on top of existing ones.
Frequently asked questions
When should access be revoked?
Set the timing with the people coordinating the departure and revoke access at the agreed point. The process should account for business needs without leaving access active longer than intended.
Should IT disable or delete an employee’s accounts?
Disabling access while retaining the account record is often a practical first step. Preserve or transfer needed business information under your organization’s policies, and delete accounts only when appropriate.
How should IT handle shared accounts and vendor access?
Identify every shared and third-party account the employee could access or manage. Remove their permissions, update account ownership and recovery details, and rotate shared credentials or keys they knew. Verify changes with the provider when necessary.
What should an offboarding record include?
Record the systems reviewed, access removed, sessions or credentials revoked, data and ownership transferred, property recovered, verification completed, and any open follow-up actions.
Make offboarding a repeatable security process
A dependable offboarding process covers identities, applications, vendors, devices, active sessions, business records, and verification. Tailor the checklist to each person’s role and document completion so important access does not get overlooked. If you would like help reviewing your organization’s security practices, Zevonix offers a free security assessment.