Employee Offboarding Checklist: The IT Side, in Order

What goes on an employee offboarding checklist for IT?

An IT offboarding checklist covers nine things, in this order: disable sign-in, revoke open sessions and tokens, transfer the mailbox and files, rotate shared passwords, remove MFA devices, recover or wipe devices, remove the person from vendor portals and banking, forward or monitor their email, and document what you did. HR runs the rest of the exit. This part is ours.

NIST’s federal control catalog says the same thing in five lines. Control PS-4, Personnel Termination, in NIST SP 800-53 Rev. 5 says that when someone leaves you should disable system access within a set time, “terminate or revoke any authenticators and credentials associated with the individual,” hold an exit interview, retrieve company property, and “retain access to organizational information and systems formerly controlled by terminated individual.” That last one is the step people skip. You need their data after they’re gone.

Here’s the checklist, step by step.

1. Disable sign-in. Block the account in Microsoft 365 or Google Workspace, and in Active Directory if you have one. Don’t delete it yet.
2. Revoke sessions and tokens. Sign the user out everywhere. More on why below.
3. Transfer the mailbox and files. Convert the mailbox to a shared mailbox or give a manager access. Hand off OneDrive or Drive files before anything gets deleted.
4. Rotate shared passwords. Wi-Fi, the copier admin page, shared logins in the password manager, anything on a sticky note.
5. Remove MFA devices. Delete their registered authenticator apps and phone numbers so an old phone can’t approve a sign-in.
6. Recover devices or wipe them. Get the laptop back. If you can’t, wipe it.
7. Remove them from vendor portals and banking. Bank logins, payroll, the line-of-business app, the domain registrar, anything that doesn’t sign in through your email.
8. Forward or monitor their email. Customers will keep writing to that address for months.
9. Document it. Date, time, who did each step.

Why isn't disabling the account enough?

Disabling an account stops new sign-ins, but it doesn’t end sessions that are already open. Microsoft’s guide to revoking user access in Microsoft Entra ID says “By default, access tokens issued by Microsoft Entra ID last for 1 hour,” and that apps using their own session cookies may never check back with Entra while that cookie is valid.

So the fix is two clicks, not one. Clear Account enabled, then select Revoke sessions on the same user. If you sync from on-premises Active Directory, Microsoft says to disable the account there and reset the password twice. Apps that have their own logins (and plenty of them do) need to be turned off in each app. That’s step 7.

This isn’t theoretical. In CISA advisory AA24-046A, an attacker got into a state government network through “the compromised account of a former employee with administrative privileges.” The organization “confirmed that this account was not disabled immediately following the employee’s departure.” From there the attacker found a domain admin password stored on a server. CISA’s fix is a “robust and continuous user management process to ensure accounts of offboarded employees are removed.”

What happens to their email and files?

Keep them, then hand them off. Microsoft’s remove a former employee guide walks through it: block sign-in, save the mailbox, wipe their phone, forward the email or convert it to a shared mailbox, give someone access to the OneDrive, then remove the license and delete the account.

The order matters because of one number. When you delete the account, Microsoft keeps that user’s OneDrive and Outlook content for 30 days, and you can restore the account in that window. After that it’s gone. If you’re in a regulated business with retention rules, decide what you’re keeping before you delete anything.

For email, forwarding to a manager or converting to a shared mailbox both work. A shared mailbox keeps the address alive so a client who emails the old address still reaches someone. Watch that inbox for a few weeks. Password reset emails from vendor portals you forgot about will show up there, and each one is a step 7 item you missed.

Which passwords have to change?

Every password the person knew and didn’t own. Their own password dies with their account. The risk is the shared ones: the office Wi-Fi, the firewall, the copier, the bank login three people use, the vendor portal with one account for the whole office.

You can’t rotate what you can’t find. That’s the case for a password manager with shared vaults, because it gives you a list of what this person could see. In our password file audit, a scan of 67 machines turned up 8 files holding real working credentials, including banking logins and a shared service account sheet that somebody had forgotten about. A departing employee may have a file like that in their Documents folder. Check for one before you wipe or hand off the machine.

What about the laptop and phone?

Get the hardware back before the last day ends if you can. If the device doesn’t come back, wipe it. If it’s a personal phone, wipe only the company data.

A wipe only works if the device can hear you. Microsoft notes that an Intune wipe has to reach a device that’s online, and an offline device “still has access to any locally stored data.” In our stolen laptop remote wipe, the device was online to our RMM agent, so we wiped it 16 minutes after the theft was reported instead of waiting for an Intune sync. The same path works for a laptop that doesn’t come back after a resignation. Document who authorized the wipe in the ticket. It can’t be undone.

How do you offboard your IT person or an admin?

Do it in a different order. With a regular employee you disable access when they leave. With someone who holds the admin passwords, you secure the admin accounts first, and you do it before or during the conversation, not after.

We’ve seen what happens otherwise. In our locked-out-of-the-domain incident report, an 85-person accounting firm’s internal IT director resigned on a Friday. On his way out he changed the domain admin password on both domain controllers, and the recovery password too. Nobody else had working admin credentials. We got all 92 machines back in 3 minutes because our RMM agent ran outside their domain, and he couldn’t reach it. Rebuilding domain access took another 6 hours.

For an admin offboarding, add these steps to the top of the list:

• Inventory every admin account they held: Microsoft 365 or Google global admin, domain admin, firewall, backup console, RMM, the domain registrar and DNS host.
• Rotate break-glass and recovery passwords, including AD recovery passwords and anything only they knew.
• Check for accounts they created: extra admin users, app registrations, forwarding rules, and remote access tools nobody approved.
• Make sure someone outside that person controls at least one admin path. A co-managed provider, a sealed break-glass account, or both.

If one person holds every admin password in your company, that’s the risk you fix this month, while they still work there.

Key takeaways

What this looks like when we do it

On our managed IT and security service, user offboarding is part of the help desk, not a billed extra. You tell us who’s leaving and when. We block sign-in and revoke sessions, hand the mailbox and files to whoever’s taking over, pull their access to shared vaults in the password manager, and work through the shared passwords they could see with you. Then we get the laptop back on the shelf or wiped through the same RMM agent that runs on every managed machine.

Each step goes in the ticket with a date, so when a cyber insurer or auditor asks how you remove access for people who leave, you have the answer on paper. And if the person leaving is your internal IT person, our co-managed IT arrangement is the outside admin path that keeps one resignation from locking you out. The managed IT service page covers the rest of the baseline.

Have someone leaving soon and want the checklist run for you? Book a call and we’ll walk through it.