How to Create an IT Offboarding Checklist: Key Elements to Add
Gregg DavisUpdated 13 min read
As an IT leader, you know that the departure of an employee brings more than just paperwork. It’s also a potential security risk.
A departing employee takes knowledge, relationships and, too often, access to systems your IT team doesn’t know about. The days between notice and the last day, or between a termination decision and the conversation itself, are a window of elevated exposure. Closing it takes a systematic, repeatable response.
That response is the IT offboarding checklist. Done well, it turns an ad hoc scramble into a sequence of tasks that doesn’t depend on anyone’s memory. Done poorly, it leaves stale accounts, unreturned devices and orphaned data behind.
In this article, we’ll cover what IT offboarding is, why a checklist matters, the elements to include, how to time it for different kinds of departures, and how to make sure it’s followed every time.
What Is IT Offboarding?
Before talking about checklists, you should first understand what IT offboarding entails.
IT offboarding is the process of removing departing employees from your company’s technological environment. It is the opposite of IT onboarding, in which you welcome new hires into your digital infrastructure.
IT offboarding involves deprovisioning user accounts, retrieving company-owned assets, and ensuring that no sensitive data remains with the departing employee.
Understanding the IT Offboarding Checklist
An IT offboarding checklist can help you manage the employee lifecycle more efficiently. It serves as a guide for your IT department, which can reduce security risks and human errors.
It should include tasks like revoking system access, reclaiming devices, securing data backups, and transferring ownership before deleting files.
Offboarding is a cross-functional process, so build the checklist with HR and legal. HR owns the timing and the conversation. IT owns system access and devices. Finance owns final pay and expenses. The manager owns knowledge transfer and project handoffs. Your IT checklist covers what IT owns, and it should plug into that wider workflow.
Why Are IT Offboarding Checklists Important?
Neglecting IT offboarding can lead to data breaches, legal complications, or even operational disruptions. You shouldn’t overlook its importance in employee lifecycle management.
Here’s why a proper offboarding checklist should be a priority for the IT department.
Prevent Unauthorized Access to Company Resources
When an employee leaves your company and their accounts aren’t properly disabled, they may still have remote access to company devices, assets, and internal systems.
Former employees, whether intentionally or not, could access sensitive information or make changes that may impact operational stability. An active account is also a target for anyone who obtains its credentials.
An IT offboarding checklist breaks down the steps to take when workers exit your company, starting with revoking their access. This significantly reduces the risk of unauthorized access.
Protect Company Data
Data is one of your company’s most valuable assets. If employees leave your company with access still intact, it increases the risk of security breaches.
During IT offboarding, it’s important to ensure that former employees no longer have access to confidential or proprietary information. This could include client data, financial records, intellectual property, local files, or even trade secrets. Our guide to data security during offboarding goes deeper on this.
Comply with Industry Regulations
Depending on your industry, failing to properly offboard employees can result in legal and financial consequences.
Regulations require companies to safeguard personal and sensitive data. If a former employee still has access to it, your company could face fines or penalties for non-compliance. Auditors look specifically for access that outlived its owner.
A checklist that records when each step was done is also your evidence that access was removed.
Maintain Control Over Company Assets
You should recover company assets, such as laptops, phones, and software licenses, during IT offboarding.
Unused licenses increase software spend, while missing devices may still hold company data or connect to company networks.
IT offboarding checklists combined with an up-to-date inventory help companies stay on top of their assets. They remind IT teams which devices need to be reassigned or retired.
Ensure Business Continuity
When an employee leaves, you should pass on their responsibilities to relevant team members without disruption.
A detailed IT offboarding checklist makes sure that all access, data, and responsibilities are transferred to the right people. This prevents workflow bottlenecks and keeps the team productive.
Key Elements of IT Offboarding Checklists
The following steps are crucial to protecting your systems, data, and assets when offboarding employees.
1. Revoking Employee’s Access to Systems and Applications
Removing access is the highest-priority task on the list. It covers internal systems like Active Directory, email, cloud services and project management tools, and third-party SaaS applications.
Start by building the full list of what the person can reach. In most organizations it isn’t documented in one place, because access piles up over years of role changes, projects and one-off requests. Combine the identity provider’s access report, your application inventory and a check with the employee’s manager.
Then disable the primary account and revoke its active sessions. Applications that sign in through single sign-on lose access when the identity provider account is disabled. Applications with their own logins need a manual step. Keep a runbook for each of those, with a named owner and a due date.
Remove other ways in too, such as multi-factor authentication devices, app passwords and personal devices linked to company accounts. If the former employee knew the password to a shared account, change it.
Centralizing access control through an offboarding platform can make this faster and more secure.
2. Removing Network and VPN Access
You should remove access to virtual private networks (VPNs) and other network devices.
In addition to terminating VPN access, deactivate remote desktop permissions and any certificates or keys issued to the user. If networks have shared passwords, change them to prevent former employees from retaining access.
You can use network monitoring tools to detect sign-in attempts from accounts that should no longer be active.
3. Preserving and Transferring Data
Disabling an account doesn’t destroy its data, but deleting it does. Before any account is deleted or any device is wiped, make sure business data is saved and handed over.
Work with the employee’s manager in the final week to decide what moves where. For most people, that means giving the manager access to the mailbox, transferring ownership of shared files and folders, and making sure code is committed and documented. Departing managers need a longer handover, which should start earlier. Our guide to IT knowledge transfer during offboarding covers the process.
Mind the deadlines your platform imposes. In Microsoft 365, when you remove a user’s license or delete their account, their email, contacts and calendar are kept for 30 days and then permanently deleted, according to Microsoft. Your data retention policy, and any legal hold, decides what you keep beyond that.
4. Reclaiming Software Licenses
When an employee leaves, reassign or release the software licenses they used.
This ensures your company isn’t paying for unused licenses and maintains compliance with software vendor agreements. You can use license tracking tools to automate this process.
5. Recovering and Inspecting Hardware
Pull the complete asset list for the departing employee from your asset management system: laptop, monitors, mobile devices, security keys, access cards and peripherals. If you don’t have an asset system, building one is a prerequisite for effective offboarding. Serial numbers on every asset make tracking easier.
For office-based employees, collect equipment on or before the last day. The employee hands it over, IT checks it against the asset list, and the device goes straight to be wiped and re-imaged or returned to inventory. Don’t let returned equipment sit in a queue, since its status is unclear until it’s processed.
Remote employees need more planning. Send a prepaid shipping kit with a box, padding and a return label well before the last day. Say clearly what needs to come back and by when. Then track the shipment and confirm receipt before you close the task. Our guide to remote employee offboarding has more on this.
When a device comes back, inspect it. Check for physical damage, such as cracked screens, broken keyboards, or missing accessories. Assess it for performance issues, outdated software, or malware. Document what you find, so you know whether repairs, replacements or a wipe are needed before reassigning it.
6. Deleting or Archiving User Accounts
One of the final steps in IT offboarding is deleting the departing employee’s accounts.
This goes beyond disabling access. You should remove their accounts from internal tools, external systems, applications, and third-party services, so no credentials remain.
Follow your company’s data retention policy to decide which accounts are deleted and which are archived for compliance reasons. Delete an account only after its data has been transferred or saved.
Removing accounts you no longer need reduces the chance of accidental reactivation and shrinks your attack surface.
Timing the Checklist for Different Departures
The same tasks apply to every departure, but their timing doesn’t.
Voluntary Resignations
With a normal notice period, offboarding can be phased. Hardware collection and knowledge transfer happen during the notice period, and access is removed at the end of the last day. In the meantime, consider removing access to sensitive systems the person no longer needs for handover work.
Involuntary Terminations
The employee shouldn’t learn of a termination from a locked account, and they shouldn’t keep access after the conversation either. Revoke access at the same time as the notification, or immediately before it. That means IT is ready to act at a set time on the day, coordinated with HR. Any gap between the conversation and the revocation is a window for harm to systems, data, or communications. Our guide to removing access for terminated employees walks through it.
Contractors and Temporary Workers
People with a known end date should have it set on their account when it’s created, so the account expires without anyone remembering to disable it. Contractor accounts that outlive the engagement are a common source of stale access. See managing contractor and temporary worker lifecycles for more.
Common IT Offboarding Challenges Faced by Businesses
Even with a solid checklist, IT offboarding isn’t always straightforward. Below are the common challenges businesses might face.
Inconsistent Offboarding Processes Across Departments
One of the biggest problems is inconsistency. When different departments manage offboarding separately, IT is often left to fill in the gaps. This can lead to oversights, like missed access points or unreturned devices.
An unstructured approach can also expose the organization to security risks, especially if employees retain access to sensitive systems.
A Checklist Nobody Follows
The most common failure is a checklist that exists but isn’t used. It sits in a shared drive, gets updated once a year, and is remembered only when someone asks whether an account was ever disabled. By then, the employee may have been gone for weeks.
Difficulty in Tracking User Access
Most organizations use many tools and applications. Tracking user access across all of them is difficult.
Overlooking even one platform can lead to security issues. For example, former employees who retain access can potentially leak sensitive data. A current inventory of each application and who has an account in it prevents that.
Ensuring Timely Completion of Offboarding Tasks
Completing offboarding tasks on time is another common challenge for IT teams, who are often handling multiple priorities.
If they can’t complete offboarding by an employee’s last day, it leaves a window for unauthorized access. It also makes it harder to recover devices and data once the employee has gone.
Retrieving Company Assets from Remote Employees
With remote and hybrid work becoming more common, retrieving company assets from departing employees is a growing challenge.
Coordinating returns across distances is hard, and relying on people to pack and ship equipment adds complexity. Remote departures also bring remote locks and wipes, cutoffs in other time zones and exit conversations by video. Our guide to remote employee offboarding covers each of them.
IT Offboarding Best Practices for IT Leaders
The best practices below address those challenges.
Start the Offboarding Process Early
Don’t wait until the employee’s last day to begin offboarding. As soon as HR confirms a departure, start preparing.
Starting early gives you time to handle data transfer, asset recovery, and compliance issues before the last day arrives. It’s better to be proactive than reactive, as delays lead to preventable security risks.
Embed the Checklist in a Workflow
A checklist works when it runs inside a workflow, not when it floats in a document. Every departure should trigger it automatically, ideally from the HR system record or an HR service request. Give each task an owner and a due date, track completion in a system that keeps an audit trail, and escalate tasks that run late.
Use Automation
Manual offboarding is time-consuming and prone to mistakes.
Automation handles repetitive tasks, such as disabling accounts, removing group memberships and reclaiming licenses. It frees your IT team for work that needs judgment.
Taken far enough, it becomes no-touch IT offboarding, where the termination in the HR system removes access with no IT ticket. See our guide to employee offboarding automation for how to get there.
No-touch offboarding also gives departing employees a smoother exit. With a lighter workload, IT and HR can focus on the parts of offboarding that need people.
Keep Detailed Documentation
Document each step of the offboarding process, from access revocation to data transfers.
Keeping a record helps in future audits or legal inquiries, especially in regulated industries. It also shows you where the process can be improved.
Review and Update Offboarding Procedures
Regularly review and update your offboarding procedures to keep them aligned with new security protocols, technologies and compliance requirements. Add new applications to the checklist as soon as they’re adopted.
Spot-check recent departures too. Confirm in the systems themselves, not just in the checklist, that access was really removed.
How Can ezOnboard Help in Offboarding Employees?
ezOnboard automates the account side of IT offboarding. It connects your company’s HR system to Active Directory, Entra ID and Exchange.
When HR records a departure, ezOnboard’s offboarding rules take over on your timeline. It disables the account, removes group memberships, reclaims Microsoft licenses and forwards mail, without IT watching an HR calendar.
Every change is recorded, giving IT and HR a shared audit trail that makes it easier to prove compliance. Safety rails stop a run that would offboard more people than your limits allow, before it changes anything.
The rest of the checklist, such as hardware recovery and applications outside your directory, stays with your team. ezOnboard takes the most time-sensitive part off their plate.
Check the ROI calculator, or request a demo today.
FAQs About IT Offboarding
What is technical offboarding?
Technical offboarding is the process of removing a former employee’s digital access to company systems. This includes revoking credentials from your identity provider, deactivating accounts, and reclaiming devices. It makes sure that only current employees have system access.
What is the most critical IT task during offboarding?
Disabling the employee’s accounts is the most time-sensitive task. An active account belonging to a former employee can be used by them or by anyone who has their credentials. Equipment return, license recovery and data archiving can follow on a longer timeline.
How should SaaS application access be handled during offboarding?
Keep an inventory of every SaaS application, who has an account, and whether it signs in through single sign-on. Accounts that use SSO lose access when the identity provider account is disabled. Accounts with their own logins need to be removed in each application’s admin console. The same inventory lets you recover their licenses.
Who is responsible for returning company equipment?
HR sets the expectation in the offboarding conversation, and IT manages the logistics. That means collecting equipment from office staff, sending prepaid return kits to remote staff, and tracking receipt to close the asset record. Equipment that isn’t returned on time should be escalated to HR.
Is offboarding the same as being fired?
No. Offboarding is a structured process that happens whenever an employee leaves, whether they resign or are let go.
Being fired refers specifically to an employee being dismissed from their role. Termination is one reason for offboarding, but offboarding applies to every departure.