# Employee Offboarding Checklist: The IT Side, in Order URL: https://limehawk.io/reports/employee-offboarding-it-checklist Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 7 min Offboarding IT in order: disable sign-in, revoke sessions, hand off mail and files, rotate shared passwords, recover the laptop, and write down what you did. > **TL;DR** The IT side of an employee offboarding checklist is nine steps, and the order matters. Disable sign-in first, then revoke the sessions that are already open, because a disabled account doesn't kill a token that's still live. Then hand off the mailbox and files, rotate every shared password the person knew, remove their MFA devices, get the laptop back or wipe it, pull them from vendor portals and the bank, route their email, and write it all down. If the person leaving is your IT person or anyone with admin rights, change the order: lock down admin access before you tell them. - Entra access token default life: 1 hour ## What goes on an employee offboarding checklist for IT? An IT offboarding checklist covers nine things, in this order: disable sign-in, revoke open sessions and tokens, transfer the mailbox and files, rotate shared passwords, remove MFA devices, recover or wipe devices, remove the person from vendor portals and banking, forward or monitor their email, and document what you did. HR runs the rest of the exit. This part is ours. NIST's federal control catalog says the same thing in five lines. Control [PS-4, Personnel Termination, in NIST SP 800-53 Rev. 5](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final) says that when someone leaves you should disable system access within a set time, "terminate or revoke any authenticators and credentials associated with the individual," hold an exit interview, retrieve company property, and "retain access to organizational information and systems formerly controlled by terminated individual." That last one is the step people skip. You need their data after they're gone. Here's the checklist, step by step. 1. **Disable sign-in.** Block the account in Microsoft 365 or Google Workspace, and in Active Directory if you have one. Don't delete it yet. 2. **Revoke sessions and tokens.** Sign the user out everywhere. More on why below. 3. **Transfer the mailbox and files.** Convert the mailbox to a shared mailbox or give a manager access. Hand off OneDrive or Drive files before anything gets deleted. 4. **Rotate shared passwords.** Wi-Fi, the copier admin page, shared logins in the password manager, anything on a sticky note. 5. **Remove MFA devices.** Delete their registered authenticator apps and phone numbers so an old phone can't approve a sign-in. 6. **Recover devices or wipe them.** Get the laptop back. If you can't, wipe it. 7. **Remove them from vendor portals and banking.** Bank logins, payroll, the line-of-business app, the domain registrar, anything that doesn't sign in through your email. 8. **Forward or monitor their email.** Customers will keep writing to that address for months. 9. **Document it.** Date, time, who did each step. ## Why isn't disabling the account enough? Disabling an account stops new sign-ins, but it doesn't end sessions that are already open. Microsoft's guide to [revoking user access in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access) says "By default, access tokens issued by Microsoft Entra ID last for 1 hour," and that apps using their own session cookies may never check back with Entra while that cookie is valid. So the fix is two clicks, not one. Clear **Account enabled**, then select **Revoke sessions** on the same user. If you sync from on-premises Active Directory, Microsoft says to disable the account there and reset the password twice. Apps that have their own logins (and plenty of them do) need to be turned off in each app. That's step 7. This isn't theoretical. In [CISA advisory AA24-046A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-046a), an attacker got into a state government network through "the compromised account of a former employee with administrative privileges." The organization "confirmed that this account was not disabled immediately following the employee's departure." From there the attacker found a domain admin password stored on a server. CISA's fix is a "robust and continuous user management process to ensure accounts of offboarded employees are removed." ## What happens to their email and files? Keep them, then hand them off. Microsoft's [remove a former employee](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/remove-former-employee) guide walks through it: block sign-in, save the mailbox, wipe their phone, forward the email or convert it to a shared mailbox, give someone access to the OneDrive, then remove the license and delete the account. The order matters because of one number. When you delete the account, Microsoft keeps that user's OneDrive and Outlook content for 30 days, and you can restore the account in that window. After that it's gone. If you're in a regulated business with retention rules, decide what you're keeping before you delete anything. For email, forwarding to a manager or converting to a shared mailbox both work. A shared mailbox keeps the address alive so a client who emails the old address still reaches someone. Watch that inbox for a few weeks. Password reset emails from vendor portals you forgot about will show up there, and each one is a step 7 item you missed. ## Which passwords have to change? Every password the person knew and didn't own. Their own password dies with their account. The risk is the shared ones: the office Wi-Fi, the firewall, the copier, the bank login three people use, the vendor portal with one account for the whole office. You can't rotate what you can't find. That's the case for a password manager with shared vaults, because it gives you a list of what this person could see. In our [password file audit](/reports/password-file-audit), a scan of 67 machines turned up 8 files holding real working credentials, including banking logins and a shared service account sheet that somebody had forgotten about. A departing employee may have a file like that in their Documents folder. Check for one before you wipe or hand off the machine. ## What about the laptop and phone? Get the hardware back before the last day ends if you can. If the device doesn't come back, wipe it. If it's a personal phone, wipe only the company data. A wipe only works if the device can hear you. Microsoft notes that an Intune wipe has to reach a device that's online, and an offline device "still has access to any locally stored data." In our [stolen laptop remote wipe](/reports/mdm-remote-wipe), the device was online to our RMM agent, so we wiped it 16 minutes after the theft was reported instead of waiting for an Intune sync. The same path works for a laptop that doesn't come back after a resignation. Document who authorized the wipe in the ticket. It can't be undone. ## How do you offboard your IT person or an admin? Do it in a different order. With a regular employee you disable access when they leave. With someone who holds the admin passwords, you secure the admin accounts first, and you do it before or during the conversation, not after. We've seen what happens otherwise. In our [locked-out-of-the-domain incident report](/reports/local-admin-provisioning), an 85-person accounting firm's internal IT director resigned on a Friday. On his way out he changed the domain admin password on both domain controllers, and the recovery password too. Nobody else had working admin credentials. We got all 92 machines back in 3 minutes because our RMM agent ran outside their domain, and he couldn't reach it. Rebuilding domain access took another 6 hours. For an admin offboarding, add these steps to the top of the list: - **Inventory every admin account** they held: Microsoft 365 or Google global admin, domain admin, firewall, backup console, RMM, the domain registrar and DNS host. - **Rotate break-glass and recovery passwords**, including AD recovery passwords and anything only they knew. - **Check for accounts they created**: extra admin users, app registrations, forwarding rules, and remote access tools nobody approved. - **Make sure someone outside that person controls at least one admin path.** A co-managed provider, a sealed break-glass account, or both. If one person holds every admin password in your company, that's the risk you fix this month, while they still work there. ## Key takeaways - Disable the account and revoke sessions together. Disabling sign-in stops new logins, but an access token that's already issued can keep working until it expires. - Every shared password the person knew is still a key in their pocket. Rotate them the same day, and start with banking and vendor portals. - Keep the mailbox and OneDrive before you delete anything. Microsoft keeps a deleted user's mail and OneDrive for 30 days, then it's gone. - Offboarding your IT person or an admin is a different job. Secure the admin accounts and the recovery passwords before the conversation, not after. - Write it down. A dated record of what was turned off, and when, is what an auditor or insurer will ask for. ## What this looks like when we do it On our [managed IT and security service](/services/managed-it-security), user offboarding is part of the help desk, not a billed extra. You tell us who's leaving and when. We block sign-in and revoke sessions, hand the mailbox and files to whoever's taking over, pull their access to shared vaults in the password manager, and work through the shared passwords they could see with you. Then we get the laptop back on the shelf or wiped through the same RMM agent that runs on every managed machine. Each step goes in the ticket with a date, so when a cyber insurer or auditor asks how you remove access for people who leave, you have the answer on paper. And if the person leaving is your internal IT person, our [co-managed IT](/industries/co-managed-it) arrangement is the outside admin path that keeps one resignation from locking you out. The [managed IT service page](/services/managed-it-security) covers the rest of the baseline. Have someone leaving soon and want the checklist run for you? [Book a call](/contact) and we'll walk through it.