An employee offboarding IT checklist has four parts: cut access the moment employment ends, hand the person's data to whoever takes over, recover and wipe every device they held, and close the loose ends such as shared passwords and licenses. Done in that order on the last day, it keeps company data from walking out the door.
Onboarding gets the attention because a new hire who cannot log in is an immediate, visible problem. Offboarding failures are quiet. The former employee's account keeps working for weeks, a shared admin password nobody rotated still opens the firewall, and the laptop sits in a closet in another state. None of it is noticed until something goes wrong. The checklist below is the one we use, written so a business without a dedicated IT team can follow it, and it fits inside a broader cybersecurity checklist for 2026.
When should IT offboarding start?
Before the person's last day, ideally as soon as HR knows the date. A planned departure gives you time to identify the data that needs handing over, arrange the device return and line up the account changes so they happen at a set time. For an involuntary departure, access should be cut at the moment the conversation happens, not after it. Agree that timing with HR in advance so IT is not improvising.
Step 1: How do you cut a departing employee's access?
Block sign-in first, then deal with everything else. Microsoft's guidance on removing a former employee from Microsoft 365 starts the same way: prevent the person from signing in before you do anything with their mailbox or files. In practice that means:
- Block sign-in on the main account in Microsoft 365 or Google Workspace, rather than deleting it straight away.
- Revoke active sessions so a phone or browser that is already signed in is logged out, not just future sign-ins.
- Remove MFA methods and registered devices so the account cannot be recovered through a phone the person still holds.
- Disable access to line-of-business systems that do not use single sign-on: the accounting package, the CRM, the payroll portal, the vendor portals.
- Rotate shared credentials the person knew, including Wi-Fi keys, alarm codes, social media logins and any shared administrator password.
The last two are where most gaps are. If a system has its own login rather than your identity provider, it will not be caught by blocking the main account. That is the strongest practical argument for single sign-on and centralized identity management: one switch turns off everything.
Step 2: How do you keep the person's email and files?
Decide who takes over before you delete anything, because deletion starts a clock. In Microsoft 365, once a license is removed the mailbox content is kept for 30 days and then deleted permanently, so the usual approach is to convert the mailbox to a shared mailbox or forward it to a manager, and to give that manager access to the person's OneDrive content first. In Google Workspace, Google's guidance on deleting a user from your organization says to transfer important data to another user before deleting the account; a deleted user can only be restored within 20 days, and data that was not transferred is gone after that.
Keep the email address active, through a shared mailbox or forwarding, for as long as customers and vendors are likely to write to it. A bounced message to a former account manager is a lost lead. If there is any prospect of a legal dispute, put a hold on the data before anything is removed.
Step 3: How do you get the device back, and what happens to it?
Every device the person used has to be accounted for: laptop, phone, tablet, hardware security keys and any USB drives issued to them. For an employee in the office, collection is simple. For a remote employee, it is the step most often left undone. Arrange return shipping with a prepaid box before the last day, and set a date by which the device is expected back.
Until the device is back in your hands, it should be locked. A managed laptop can be locked or wiped remotely, and an encrypted one is unreadable even if it never comes back. When it does return, wipe it to the standard in NIST's media sanitization guidelines before it is reissued or retired, and update the asset record with its new status. Company data on a personal phone is handled by removing the work profile or managed apps, not by wiping the person's own device.
Step 4: What loose ends get missed?
These are the items that are still open months later when someone finally checks:
- Licenses. Reassign or cancel the person's software licenses so you are not paying for an empty seat.
- Group memberships and distribution lists. Remove the account from shared mailboxes, Teams or shared drives it no longer needs.
- Calendar entries. Recurring meetings the person organized can be cancelled or reassigned so they do not linger.
- Delegated access. Check whether anyone gave the departing employee access to their own mailbox or files, and remove it.
- Personal devices with work accounts. Confirm the work account is removed from any personal phone or home computer.
- Asset records. Mark the device returned, reassigned or retired, with the date.
The checklist on one page
| When | Task | Owner |
|---|---|---|
| Notice given | Confirm last day and access cut-off time; identify the data owner who takes over | HR and IT |
| Before last day | Arrange device return; transfer files and set mailbox handover | IT and manager |
| Cut-off time | Block sign-in, revoke sessions, remove MFA methods, disable non-SSO apps | IT |
| Same day | Rotate shared passwords and codes the person knew | IT |
| Device returned | Wipe, reimage or retire; update asset record | IT |
| Within 30 days | Reassign or cancel licenses; delete or archive the account | IT |
How do you make offboarding repeatable?
Write the checklist down, attach it to the HR process so IT is told the moment a date is set, and automate the parts that can be automated. When devices are enrolled in management from the day they are issued, locking, wiping and tracking them is a few clicks rather than a hunt. When identities are centralized, cutting access is one action rather than ten. The same tooling that makes onboarding fast makes offboarding complete.
That is how Atlas runs it for clients. Our device provisioning and onboarding service covers both ends of employment: new laptops shipped straight to the user and set up at first sign-in, and departures handled with sign-in blocked, data handed over, devices locked or wiped and returned, and asset records kept current.
Frequently asked questions
Should we delete a former employee's account right away?
No. Block sign-in immediately, but keep the account until their email and files have been handed to someone else. Deleting first starts a short retention window, after which the data is unrecoverable.
What if a remote employee does not return their laptop?
Lock it remotely so it cannot be used, and rely on disk encryption to keep the data unreadable. Then follow up through HR with the return arrangements. A laptop that was never under management or never encrypted is the scenario to avoid, which is why both should be set up on day one.
Do we need to change passwords when someone leaves?
Their own password stops mattering once the account is blocked. Shared credentials are the risk: any password, code or key the person knew that is used by more than one person should be changed the same day.
How long should we keep a former employee's mailbox?
As long as your retention policy, legal obligations and business needs require. In Microsoft 365, converting it to a shared mailbox keeps the content available and, within Microsoft's size limits for shared mailboxes, frees the user license.
The Cyber-Insurance Questionnaire Gap Check
Covers MFA, endpoint protection, backups, email security, incident response and training. Each question comes with the evidence an underwriter expects to see.