Employee Offboarding Checklist For IT, Plus The Onboarding Half

An employee offboarding checklist for IT lists every account, device, and file a leaver touches, and the hour each one is closed, collected, or handed over. Run it on one ticket from the day notice arrives to day 30. The onboarding half runs the same way, in reverse.

Copy the checklist or download it below. It comes from the team behind SherpaDesk, a helpdesk and professional services automation (PSA) tool a small IT team can run alone.

What An Employee Offboarding Checklist Covers For IT

Employee offboarding is the work of closing out an employee's access, equipment, and data when they leave. HR owns the paperwork: the final paycheck, benefits, and the exit interview. IT owns the systems half.

An employee offboarding process matters because leavers are routine, not rare. In September 2026, US employers recorded 5.3 million separations, 3.3% of employment. At that rate, a 60-person company sees about two leavers a month.

CIS Safeguard 6.2 asks for a process that revokes access "through disabling accounts immediately upon termination, rights revocation, or role change of a user." Safeguard 6.1 asks for a documented process to grant access "upon new hire or role change of a user." Under NIST's PS-4, you set a deadline for cutting a leaver's access, then keep their files reachable for whoever takes over.

Our helpdesk SOP guide has the short SOP version of this offboarding checklist. Taking on a whole new client? Use the MSP client onboarding checklist.

The Employee Offboarding Checklist Template, With Onboarding

Part A covers a new hire; Part B is the employee offboarding process, from notice to day 30. Fill in the brackets; delete lines you don't use.

IT ONBOARDING AND OFFBOARDING CHECKLIST
Company or client: [name]
IT owner: [name] · Requests come from: [HR or client contact]
One ticket per person. Tick each line on the ticket.

PART A. ONBOARDING (NEW HIRE)

INTAKE (when the offer is signed)
[ ] Legal name and preferred display name
[ ] Start date, start time, office or remote
[ ] Role, department, manager
[ ] Employment type; end date if fixed-term
[ ] Role list: [role name]
[ ] Extra access approved in writing by [manager]

BEFORE DAY ONE ([3-5] working days before)
[ ] Account created, added to role groups only
[ ] Licenses assigned: [email, office apps, other]
[ ] Accounts made in apps outside single sign-on
[ ] Laptop from stock: updated, enrolled, labeled
[ ] Laptop assigned to the user in the inventory
[ ] Phone, badge, and peripherals ready

DAY ONE (first hour)
[ ] Identity checked before the first password
[ ] MFA enrolled before the user leaves the desk
[ ] Devices handed over, receipt signed
[ ] Sign-in tested in every app on the role list
[ ] User shown how to reach the helpdesk

FIRST WEEK
[ ] Manager confirms access is complete
[ ] Access added since day one: approved, noted
[ ] Ticket closed with notes

PART B. OFFBOARDING (LEAVER)

WHEN NOTICE ARRIVES
[ ] Last day, and the hour access ends: [time]
[ ] Exit type: [resignation / contract end /
    dismissal]
[ ] Data goes to: [manager or successor]
[ ] Accounts listed: directory, email, every
    app with its own sign-in or sessions, API
    tokens and keys, admin roles, VPN, shared
    passwords the person knows
[ ] Devices listed from the inventory record
[ ] Device return booked: [in person / courier]

LAST DAY (at the agreed hour)
[ ] Sign-in disabled, sessions revoked
[ ] Password reset, MFA methods removed
[ ] Each app: account disabled, sessions
    ended, API tokens and keys revoked
[ ] Shared passwords the person knew changed
[ ] Laptop, phone, tokens, and badge collected
[ ] Mailbox converted to shared (keeps old
    mail) or forwarded (new mail only; keep the
    license; review on [date])
[ ] Auto-reply names the new contact

AFTER THE LAST DAY (days 1-5 = working days;
day 30 = calendar days)
[ ] Days 1-5: files and old mail handed to
    [name], who confirms they open
[ ] Days 1-5: meetings cancelled, owned
    calendars transferred
[ ] Before each wipe: local files copied and
    opened by [name], or none found
[ ] Devices wiped, inventory updated
[ ] Day 5: license reclaimed only for a shared
    mailbox under 50 GB with no archive, hold,
    or other licensed feature
[ ] Day 30: account deleted per [policy], or
    kept disabled while it anchors forwarding
    or a shared mailbox
[ ] Ticket closed with notes

DISMISSAL: disable access when the meeting starts.
ROLE CHANGE: run the role list again; remove what
the old role needed.

Before you use it, write one role list per job: the groups, licenses, apps, and devices that role gets. One r/sysadmin poster keeps roles in a Word doc, where "it's easy to check off the 'per role requirements' task as completed and have missed something on the word doc."

How To Prepare The Onboarding Half

An IT manager running a four-person team for about 700 users wrote that both processes "take a lot of time," with "frequent mistakes, either on our side or from HR." A reply: "The tool matters, but the bigger issue is usually the HR handoff."

Intake

Get the request as a ticket with fixed fields, not an email. You need the legal and preferred name, start date and time, location, role, manager, and employment type. For a fixed-term contract, take the end date now, so offboarding already has a date. Any access beyond the role list needs written approval; NIST's account management control asks for named approvers on requests to create accounts.

Before day one

Create the account three to five working days ahead. One poster described accounts "created 2 months early and day one they have 500 office emails that are completely irrelevant."

Add the account to the role's groups only. NIST's least privilege control allows only the access a person needs for their assigned tasks. Then make accounts in the apps your single sign-on doesn't reach, and prepare the laptop: updated, enrolled, labeled, and assigned to the user in your IT asset inventory.

Day one

Check the person's identity before you hand over the first password, as NIST's authenticator control asks. Enroll MFA while they're still at the desk: CIS asks for MFA, where supported, on externally exposed apps and on all administrative access. Hand over the laptop and phone against a signed receipt, test sign-in in every app on the role list, and show them how to reach the helpdesk.

First week

Ask the manager to confirm access is complete. Anything added since day one gets an approval on the ticket.

How To Run The Employee Offboarding Process, Step By Step

The employee offboarding process has three stages: prepare when notice arrives, cut access at an agreed hour, then hand over data and reclaim licenses over the next 30 days.

When notice arrives

Open the offboarding ticket the day HR or the client tells you. Write down the last day and the exact hour access ends, agreed with the manager.

Then build the offboarding inventory for this person. List the directory account, email, every app they use (single sign-on apps keep their own sessions too), API tokens and keys, admin roles, VPN, and any shared password they know. Pull their devices from the asset record, and book the return, in person or by courier. Decide now who receives their mail and files.

The last day, at the agreed hour

At the offboarding hour, disable sign-in and revoke sessions together. In Microsoft Entra ID, access tokens last one hour by default, and Entra "can't directly revoke a session token issued by an application." So in every app, single sign-on or not, disable the account, end its sessions, and revoke personal API tokens and keys.

Remove their MFA methods; NIST asks you to revoke every authenticator and credential tied to the leaver. Change every shared password they knew, as NIST also asks. Collect the laptop and phone, plus the hardware tokens and badge NIST counts as property to retrieve.

The last offboarding step that day is the mailbox. Converting it to a shared mailbox keeps the old mail; forwarding passes on only new mail. Either way, keep the account: it anchors both.

Forwarding also needs the license kept, or it stops. Keep the shared mailbox's sign-in blocked, and set an auto-reply naming the new contact.

Dismissals

For an involuntary exit, the offboarding process changes order: disable access when the meeting starts, not after it. NIST notes that in certain situations, organizations consider disabling a terminated person's accounts before the person is notified.

After the last day

Working days 1 to 5 of the offboarding process are for data; day 30 counts calendar days. Cancel the leaver's meetings, then check this table before deleting anything.

So the license goes last: convert the mailbox while it's still licensed, hand over the files, then reclaim it. Reclaim it only if the shared mailbox is under 50 GB and needs no archive, hold, or other licensed feature. With forwarding, keep the license until the review date.

Before any wipe, the recipient confirms they can open the files, and anything saved only on the laptop is copied off. Then wipe it and update its inventory record; see our asset lifecycle guide for methods.

At day 30, the offboarding ends: delete the account or keep it disabled, per your retention policy. Keep it while it anchors forwarding or a shared mailbox.

Your quarterly account review catches what any offboarding missed. CIS asks you to confirm at least quarterly that every active account is authorized, and disable accounts dormant for 45 days, where supported.

When Someone Changes Roles

A promotion or a move to another department is half an offboarding and half an onboarding. NIST's personnel transfer control (PS-5) asks you to review whether a mover still needs their current access.

Run the new role list the day the move takes effect, and remove whatever only the old role needed. A mover who keeps finance access from their last job is an offboarding nobody ran.

Filled-In Example For A Small Clinic

Say you run Northgate IT, a three-technician MSP, with lead tech Priya Shah and technician Marcus Bell. Your client, Lakeside Family Clinic, has 38 staff on Microsoft 365. Office manager Joan Mills resigns; her last day is Friday, November 13, 2026. Her successor, Ray Ortiz, starts Monday, November 16. Dr. Ellen Park, the practice owner, approves the offboarding and the new hire.

Offboarding Mistakes Small IT Teams Make

In our experience, offboarding breaks on bad input and step order, not on missing tools. One r/sysadmin member advised building "the joiner and leaver checklists as written runbooks first. Automating a messy process just lets you make the same mistakes faster".

Another poster wrote: "I haven't been able to get technicians to use external files like Word or Excel." An offboarding checklist on the ticket gets ticked because the ticket is where the work already is.

Run Both Checklists From Your Helpdesk

About the author

Patrick Clements Co-founder & CEO, SherpaDesk

Patrick co-founded SherpaDesk and has led it as CEO since 2013. He has worked with IT service providers since 1998, first on network projects for schools and government offices, then on the helpdesk software their technicians use every day.

All Articles