In this guide 8 sections
An employee offboarding checklist makes sure that when an employee leaves, their system access is removed on their final day, company data and institutional knowledge stay with the business, company equipment comes back, and shared passwords are changed. This employee offboarding IT checklist covers the IT side of the offboarding process for small businesses and shows where it links with HR tasks such as the exit interview and final pay. Allow 30 to 60 minutes per departing employee with Microsoft 365 or Google Workspace.
Why the offboarding process matters
Former employees who keep access are one of the easiest ways for data breaches to happen. Most employees leave on good terms, but a forgotten login, an old remote access account or a personal phone still syncing email can expose company data months later. A structured process also protects business continuity: current projects, client knowledge and shared accounts are handed over rather than lost. And a positive offboarding experience is part of the wider employee experience and company culture. How you treat exiting employees is noticed by remaining team members and future employees.
Before the employee's final day
- Confirm the notice period and the time access ends. Agree it with the manager and the HR team. For a difficult departure, plan access revocation for the moment you tell them.
- List every system they can access. Microsoft 365 or Google Workspace, SaaS tools, line-of-business apps, banking and payment portals, supplier portals, social media channels, the building alarm and shared accounts.
- Plan knowledge transfer. Ask the outgoing employee to document current projects, processes and contacts, and to transfer ownership of files and shared documents to remaining team members.
- Decide what happens to their email and files. Who needs their mailbox? Which files move to shared storage?
- Coordinate with human resources. HR handles the exit interview, final pay and any severance pay, and necessary paperwork such as a signed confidentiality reminder. IT needs the same final day so both processes line up.
On the employee's final day: access revocation
- Block sign-in and sign them out everywhere. In Microsoft 365, block sign-in and revoke sessions so the departing employee is logged out of every device, not just the office PC. Do the same in Google Workspace if you use it.
- Remove MFA methods registered to their personal phone.
- Convert their mailbox. Convert it to a shared mailbox or grant their manager access, and set an auto-reply pointing people to a new contact. Converting to a shared mailbox usually frees the licence.
- Transfer OneDrive or Drive files to their manager or a shared location before the account is removed.
- Remove access permissions from groups, Teams, shared mailboxes and distribution lists.
- Disable remote access such as VPN and remote desktop, and any SaaS tools that don't use your Microsoft or Google login.
- Collect company assets and company property: laptop, mobile devices, security keys and access cards. Wipe company data from any personal phone they used for work.
After the employee leaves
- Change shared passwords they knew: Wi-Fi, alarm codes, shared accounts and any password manager vault they could open.
- Check for email forwarding rules set to a personal address, and remove them.
- Reassign or cancel licences so you stop paying for them.
- Wipe and reissue their laptop once company data has been checked and retained.
- Keep a record of what was removed, by whom and when. It's evidence if there's ever a question about data security.
Employee offboarding checklist template
| Task | Owner | Done |
|---|---|---|
| Final day and notice period confirmed | Manager / HR | ☐ |
| Access list completed | IT | ☐ |
| Knowledge transfer and handover done | Manager | ☐ |
| Exit interview booked | HR | ☐ |
| Sign-in blocked and sessions revoked | IT | ☐ |
| MFA methods removed | IT | ☐ |
| Mailbox converted, auto-reply set | IT | ☐ |
| Files transferred | IT | ☐ |
| Remote access and SaaS access removed | IT | ☐ |
| Company equipment returned | Manager | ☐ |
| Shared passwords changed | IT | ☐ |
| Forwarding rules checked | IT | ☐ |
| Licences reassigned | IT | ☐ |
| Final pay processed | HR | ☐ |
Security considerations for remote employees
For remote employees, arrange courier return of company equipment before the final day, and use device management to lock or wipe a laptop that hasn't come back. Revoking sessions matters even more when the device isn't in the office.
When to call a professional
If the person had admin access, set up systems themselves, or the departure needs immediate attention, get your IT provider to handle the entire offboarding process and check for accounts you don't know about. Static Computers handles employee offboarding (and onboarding for new hires) for clients as part of managed IT services.