An IT offboarding checklist makes sure that when someone leaves, every account is disabled, every access is revoked, their data is preserved, and their devices are recovered – ideally the same day. Incomplete offboarding is a common and avoidable security gap.
On the last day (or before, for a difficult departure)
- Disable the user account and reset the password
- Revoke MFA sessions and app tokens – a disabled account with a live session is still a risk
- Remove from all groups, shared mailboxes, admin roles
- Revoke access to line-of-business apps, the password manager, VPN, and any third-party systems
- Convert the mailbox to shared or set up forwarding, per your retention policy
- Change any shared or service-account passwords the person knew
Devices and data
- Recover laptops, phones, tokens, access cards
- Wipe or re-image recovered devices
- Preserve their files and email per your data-retention policy before deleting anything
- Check for company data on personal devices or cloud accounts
Follow-up
- Remove the licence once the mailbox is handled – stop paying for it
- Update documentation and asset records
- For a privileged user, review logs for the period around their departure
Run it every time, the same way – by you or your IT provider. Pair with the onboarding checklist.
IT buyer’s guides
- What is a managed service provider?
- How much do managed IT services cost?
- Break/fix vs managed IT services
- What to look for in an IT support contract
- In-house vs outsourced vs co-managed IT
- How to switch IT providers
- Signs your IT provider is failing you
Thinking about managed IT in Edmonton? Call +1 (587) 400-9991 (also on WhatsApp) or request a quote. We start with a short review at no cost.
Frequently asked questions
How quickly should we offboard someone?
Same day for a normal departure; immediately and before notice for a termination or a security concern. A lingering active account is a real risk.
What is the biggest offboarding risk?
Access that is missed – a SaaS app IT did not know about, a shared password that was not changed, a live session on a ‘disabled’ account. A complete checklist and a full app inventory prevent it.
Can we just delete the account?
Not immediately – preserve the mailbox and files per your retention policy first, then remove the licence. Deleting too fast loses data you may need.
Does Scandifix handle offboarding?
Yes – on a managed plan we run a full offboarding checklist on request: accounts disabled, access revoked, data preserved, devices recovered, licence removed.