IT Offboarding: Revoking Access on an Employee's Last Day

For a planned departure, you have time, so use it. When HR confirms the last day:

• Pull the employee's access list: identity provider groups, applications, shared mailboxes, admin roles, API keys and any systems they set up.
• Identify data and accounts they own that someone else must take over, such as shared documents, customer accounts and scheduled jobs.
• Agree with the manager who receives forwarded mail and who takes over each duty.
• Schedule the revocation for a specific time on the last day, and tell IT and the manager the time.
• Arrange return of equipment, with a prepaid label for remote staff.

For a sudden departure or a for-cause exit, skip the schedule and revoke immediately once HR gives the go-ahead. The order below is the same either way.

Follow this sequence so the most powerful access disappears first:

1. Disable the person's account in the identity provider or single sign-on, which cuts off every connected app at once.
2. Sign out all active sessions and revoke tokens, since disabling the account doesn't always end sessions already open.
3. Reset or remove multi-factor authentication devices tied to the account.
4. Convert or forward the mailbox to the manager, set an out-of-office reply, and keep the data in line with your retention policy.
5. Remove access to apps that don't use single sign-on, one by one, from your list.
6. Rotate any shared passwords, API keys and service credentials the person knew.
7. Remove them from code repositories, cloud consoles, payment tools and admin roles, and reassign ownership.

Log the time of each step. In an incident review, that record shows you acted promptly.

Shared credentials are the gap that a disabled account doesn't close. If the person knew a shared login for a vendor portal, a social account or a database, that password is still valid after they leave. Rotate it the same day and share the new one through your password manager.

Check these places, since they're easy to miss:

• API keys and tokens the person created for integrations, which may keep working after their account is disabled.
• Admin roles in SaaS tools where they were the only administrator.
• Personal accounts used for business, such as a personal email registered with a vendor.
• Payment cards, expense tools and bank approvals.
• Domain registrar, DNS and website hosting logins.

A useful habit is keeping a list of which credentials each senior person controls, updated at least yearly. If the list is missing, this is when you feel it.

Collect the laptop and any phones, tokens or badges. For remote staff, send a prepaid return label and confirm delivery. Don't power on or browse the device before it's secured; if you suspect misconduct, preserve it as it is and ask counsel how to proceed.

Then handle data deliberately:

1. Transfer ownership of shared files, calendars and documents to the manager or a named colleague before the account is deleted.
2. Back up what your retention policy says to keep, such as email and files that may be needed for legal or business reasons.
3. Wipe the device to factory settings once the data is preserved, and record the wipe.
4. Remove the device from device management and update the asset register.
5. Delete the account after the retention period, not on day one, since deleting immediately can destroy files others rely on.

The laptop provisioning checklist uses the same asset register you update here.

Verify, don't assume. A week after departure, review these:

• The identity provider shows the account disabled, with no active sessions.
• Each app on the access list confirms the user is removed, or you've checked directly.
• Sign-in logs show no attempts by the former employee after their last day.
• Shared credentials have new values, and the old ones no longer work.
• The asset register shows the device returned and wiped.

Once a quarter, compare your active user lists in key systems with your current headcount from HR. Any account without a matching employee needs an explanation. This catches missed offboardings from any period. To close the loop on the front end of the employee lifecycle, see the 30-day onboarding checklist and first employee hiring checklist. The operations audit checklist can include offboarding as one of its checks, and vendor onboarding covers a similar access-control problem for outside parties. For managing devices at scale, see the device management comparison.