An IT offboarding checklist is a structured list of access revocation and device recovery tasks that IT completes when an employee leaves. It covers identity provider deactivation (Okta, Google Workspace, Microsoft Entra ID), SaaS revocation, MFA and session reset, shared credential rotation, device wipe or recovery, data handover, and audit log review. Everything on it should be finished on or before the last working day.
Below is the full checklist, split by area and by timing, with a copy-ready version at the end.
Why IT Offboarding Is Your Biggest Post-Departure Security Risk
The accounts you forget are the ones that cause problems. A former employee with a live login, a personal API key still running in production, or a shared password nobody rotated is a standing risk that grows with every exit handled informally.
The usual gaps are predictable:
- Apps outside single sign-on. Tools signed into with email and password are not switched off when the identity account is suspended.
- Long-lived tokens. OAuth grants, API keys, and personal access tokens keep working after the password changes.
- Shared credentials. Team logins, vault items, and admin accounts the person knew are rarely rotated.
- Devices. Laptops that are never returned or never wiped still hold company data.
- Unused licences. Seats stay assigned and billed for months.
A consistent checklist closes each of these on a fixed schedule instead of relying on memory.
IT Offboarding Checklist at a Glance
| When | Task | Owner |
|---|
| Notice given | Receive departure alert with the confirmed last day | HR to IT |
| Notice given | Build the full access inventory for the leaver | IT |
| During notice | Reduce admin and sensitive permissions | IT and manager |
| During notice | Transfer ownership of files, repos, and cloud resources | Leaver and manager |
| During notice | Send device return kit to remote staff | IT |
| Last day | Suspend identity account and revoke sessions | IT |
| Last day | Revoke non-SSO apps, tokens, and keys | IT |
| Last day | Rotate shared credentials | IT |
| Last day | Recover or remotely lock devices | IT |
| After departure | Review audit logs and reclaim licences | IT |
| After departure | Confirm completion and store the record | IT |
Before the Last Day: Preparation Checklist
- Get the confirmed last day and exit type (voluntary or involuntary) from HR.
- Pull the user's app list from your identity provider, SaaS management tool, and expense or card data to find tools bought outside IT.
- Identify admin roles, shared mailboxes, vault items, and service accounts the person uses.
- List resources the person owns: documents, repositories, dashboards, cloud projects, scheduled jobs, and automations.
- Ask the manager to name a successor for each owned resource.
- Remove unnecessary admin or production access during the notice period, especially for sensitive roles.
- For involuntary exits, plan revocation to happen at the same time as the termination meeting.
Identity Provider and SSO Checklist (Google Workspace, Okta, Microsoft Entra ID)
- Suspend the primary identity account first to break SSO for connected apps.
- Sign the user out of all sessions and revoke refresh tokens.
- Remove OAuth grants to third-party apps.
- Reset MFA and remove registered devices, authenticator apps, and security keys.
- Remove the user from groups, distribution lists, and dynamic access rules.
- Transfer mailbox, calendar, and drive ownership to the successor.
- Convert the mailbox to shared or set auto-forwarding if continuity is needed.
- Keep the account suspended, not deleted, until data transfer and any legal hold are confirmed.
SaaS Tool Revocation Checklist: Slack, GitHub, Notion, Salesforce, and More
SSO does not cover everything. Revoke each tool in your inventory and record it:
- Communication: Slack, Microsoft Teams, Zoom, Google Meet. Deactivate the user and remove from shared channels with external partners.
- Code and infrastructure: GitHub, GitLab, Bitbucket, AWS, Google Cloud, Azure, Vercel, Firebase. Remove org membership, revoke personal access tokens and SSH keys, and check IAM users and roles.
- Documents and knowledge: Notion, Confluence, Google Drive, Dropbox, Box. Transfer ownership before removal.
- CRM and sales: Salesforce, HubSpot, sales engagement and dialler tools. Reassign records and open deals.
- Finance and billing: accounting software, expense tools, payment dashboards, and company cards. Cancel or reassign cards on the last day.
- Marketing and social: ad accounts, analytics, CMS, domain registrars, and company social profiles. Change passwords on any shared social logins.
- Design and product: Figma, Jira, Linear, Miro. Transfer project ownership.
Shared Credentials, API Keys, and Admin Access Checklist
- Rotate every shared password the leaver could see, starting with admin and financial accounts.
- Remove the user from password manager shared folders and review what they accessed.
- Revoke personal API keys and tokens, and rotate any keys they created that other systems depend on.
- Reassign service accounts, bots, webhooks, and scheduled jobs they own so nothing silently breaks.
- Transfer ownership of domains, DNS, certificates, and app store accounts if they were the registered contact.
- Update on-call rotations, escalation contacts, and vendor support contacts.
Device, Hardware, and MDM Offboarding Checklist
- Recover laptops, phones, monitors, security keys, and access badges.
- For remote staff, send a prepaid return kit as soon as the last day is confirmed. See offboarding remote employees.
- Remotely lock the device through MDM if it is not returned on time.
- Wipe and reimage returned devices, and record the serial numbers.
- For BYOD, remove the work profile and confirm no company data remains.
- Disable building access, VPN, and Wi-Fi certificates.
Data, Files, and Cloud Storage Handover Checklist
- Transfer ownership of documents, repositories, and dashboards before deactivating accounts.
- Export or archive data needed for legal, tax, or compliance retention.
- Preserve anything under legal hold and flag it before any deletion.
- Set an email auto-reply or forwarding rule for clients and partners.
- Check for company data synced to personal cloud storage and request deletion where appropriate.
After the Last Day: Audit and Cleanup Checklist
- Review identity provider and key app audit logs for unusual downloads, forwarding rules, or access in the final weeks.
- Confirm no logins occur after the revocation time.
- Reclaim and cancel paid licences so you stop paying for them.
- Delete or archive the account after the retention period in your policy.
- Record completion with timestamps. This record is the evidence auditors ask for under SOC 2 and ISO 27001.
Voluntary vs Involuntary Exits: What Changes for IT
| Voluntary resignation | Involuntary termination |
|---|
| Timing of revocation | End of last working day | At the same time as the termination meeting |
| Permission reduction | Gradual during notice | Immediate |
| Knowledge handover | Planned during notice | Done by the manager from existing access and records |
| Device recovery | Returned on or before last day | Collected at the meeting or locked remotely |
How to Automate IT Offboarding Without SCIM
Not every app supports SCIM or automated deprovisioning, and those are the apps most often missed. Offboarding software keeps the full app inventory per employee, assigns each revocation as a task with a deadline, and records confirmation, so manual steps are tracked as carefully as automated ones. Track every revocation in OffboardSet.
Pair this with the broader employee offboarding process and the HR and manager checklist. If you are evaluating tools that can run this for you, see the best employee offboarding software.
If access governance is your main gap, compare tools in our Lumos alternatives guide, and for a view that includes people workflows see the best employee offboarding software.
FAQs
What is IT offboarding?
The process of revoking system access, recovering devices, rotating shared credentials, and securing company data when an employee leaves.
When should IT revoke access for a leaving employee?
At the end of the last working day for resignations, and at the same time as the termination meeting for involuntary exits. Sensitive permissions can be reduced earlier during the notice period.
How do I revoke access when an employee leaves without SCIM?
Keep an app inventory for each employee and revoke each tool manually as a tracked task. Offboarding software automates the tracking and confirmation so nothing is missed.
What is a deprovisioning checklist?
A list of every account, credential, token, and device tied to an employee that must be disabled, rotated, or recovered when they leave.
How do I offboard an employee from Google Workspace?
Suspend the account, sign the user out and reset sign-in, transfer Drive and mailbox ownership, remove them from groups, then delete or archive after the data transfer is confirmed.
Should you delete or suspend a former employee's account?
Suspend first. Deleting too early can lose files and email you still need. Delete or archive once ownership is transferred and your retention period has passed.
Run your offboarding the right way
OffboardSet coordinates HR, IT, and managers, captures knowledge, and keeps every leaver in your alumni network.
