Employee Offboarding Checklist

Before the leaving date

• Confirm leaving date, access removal time, manager, and HR or operations owner.
• Identify company devices, accessories, security keys, and any personal devices with work data.
• List Microsoft 365, Google Workspace, finance, CRM, HR, password manager, code, and supplier systems.
• Confirm whether files, shared drives, mailbox access, calendar ownership, and phone numbers need handover.
• Agree whether the account is disabled immediately or at a scheduled time.
• Identify any admin roles or privileged access that must be removed first.

Access removal checklist

• Block sign-in, suspend, or disable the account at the agreed time.
• Revoke active sessions where the platform supports it.
• Remove group memberships, shared mailbox access, delegate access, and privileged roles.
• Transfer file, mailbox, calendar, or shared drive ownership where needed.
• Remove third-party application access and connected OAuth apps where applicable.
• Remove password manager access and rotate shared credentials if the leaver had access.
• Document completed steps and any exceptions.

Device and data handling

Device recovery should be part of offboarding, not a separate afterthought. If a device cannot be returned quickly, decide whether remote lock or wipe is appropriate for your policy, employment context, and tooling.

Data handling should be practical and deliberate. Preserve what the business needs, transfer ownership before deleting accounts, and avoid keeping old active accounts just because nobody is sure what they own.

After offboarding