Free printable checklist
Employee offboarding IT checklist: what to revoke, recover and transfer
When someone leaves, their access does not leave with them unless somebody turns it off. This checklist covers what to revoke, what to collect and what to hand to someone else, so nothing is missed whether the departure is friendly or not.
- Timeframe
- Before, on and after the last day
- Steps
- 23
- Last reviewed
- October 2, 2026
- Price
- Free, no sign-up
Who this is for: Owners, office managers and HR staff at businesses of 10 to 250 people, with or without in-house IT.
0 of 23 done
Your checkmarks are saved in this browser only. The printout is a blank copy.
1.Before the last day: plan the handoff
0 of 4For a planned departure, do this a week or two out. For a sudden or unfriendly one, do it in the hour before the conversation.
You cannot turn off what you do not know about, so include email, accounting, payroll, banking, vendor portals and any cloud apps they signed up for themselves.
Who: Manager and IT provider
Microsoft's offboarding guide notes that forwarding their email keeps messages from customers and partners reaching the person taking over the work.
Who: Manager
If a dispute is possible, the mailbox may need a hold, and Microsoft says that has to happen before the account is deleted.
Who: Owner or HR
The FTC advises a set procedure so people who leave no longer have access to sensitive information.
Who: HR and IT provider
2.On the last day: cut off access
0 of 8Do these in order, ideally while the exit conversation is happening.
One switch in Microsoft 365 or Google Workspace shuts the door to email, files and the apps that use that login; in Microsoft 365 it is disable the account, then revoke sessions.
Who: IT provider
Phones and browsers can stay signed in for a while after an account is turned off, which is why Microsoft recommends revoking sessions as well.
Who: IT provider
Multi-factor authentication (MFA, the second check such as a code on a phone) tied to their personal phone should stop working, and Microsoft lets admins delete those methods.
Who: IT provider
Remote access is the easiest way back into your network, and it is often set up separately from the main account.
Who: IT provider
Who: Office manager
If they set up your website domain, social media pages or a cloud app under their own login, you could lose control of it later.
Who: IT provider and office manager
Banks and card issuers keep their own user lists, so turning off email does not touch financial access; call each one.
Who: Owner
Supplier portals, shipping accounts, tax sites and benefits portals each have separate logins that someone has to close by hand.
Who: Office manager
3.Recover devices and property
0 of 4Company devices hold company data, and a device you do not have is one you cannot wipe or reissue.
Who: Manager
The FTC lists collecting keys and identification cards as part of the check-out routine.
Who: Office manager
If they read work email on their own phone, a selective wipe removes company data and leaves personal photos alone, but it only works when the phone is online.
Who: IT provider
The FTC warns that ordinary delete commands leave files that can be recovered, so use a proper wipe before reissuing or recycling.
Who: IT provider
4.After they leave: transfer and tidy up
0 of 7Who: IT provider
Microsoft notes that inbox rules survive a mailbox conversion, so a rule sending mail to a personal address keeps running until someone removes it.
Who: IT provider
Microsoft keeps a deleted user's OneDrive and mailbox for 30 days and then it is gone, so move what matters before deleting anything.
Who: Manager and IT provider
A freed license can go to the next hire or come off the bill; Microsoft holds the mailbox data tied to a removed license for 30 days, then deletes it.
Who: Office manager and IT provider
Customers who call their direct line should reach a person, not a voicemail box no one checks.
Who: Office manager
Large downloads or new forwarding in the last few weeks are worth spotting early, while you can still act on them.
Who: IT provider
A dated record proves access was removed, which customers, insurers and auditors may ask to see.
Who: HR
Who does what on this checklist?
Every step names an owner so nothing waits on a single person. Hand each owner their rows below, and agree ahead of time who covers if someone is out.
| Owner | Steps | Where they appear |
|---|---|---|
| IT provider | 9 | On the last day: cut off access; Recover devices and property; After they leave: transfer and tidy up |
| Office manager | 4 | On the last day: cut off access; Recover devices and property; After they leave: transfer and tidy up |
| Manager | 2 | Before the last day: plan the handoff; Recover devices and property |
| Manager and IT provider | 2 | Before the last day: plan the handoff; After they leave: transfer and tidy up |
| HR | 1 | After they leave: transfer and tidy up |
| HR and IT provider | 1 | Before the last day: plan the handoff |
| IT provider and office manager | 1 | On the last day: cut off access |
| Office manager and IT provider | 1 | After they leave: transfer and tidy up |
| Owner | 1 | On the last day: cut off access |
| Owner or HR | 1 | Before the last day: plan the handoff |
How do you make this checklist work in real life?
A checklist only helps if the right people know it exists before they need it. These habits make the difference.
- Start the access list on day one. Each time someone gets a new login, add it to their row, and offboarding becomes reading a list instead of remembering.
- Give one person ownership of offboarding, usually the office manager or HR, with the IT provider doing the technical steps.
- Put the rules in writing so they apply to everyone the same way. Our free Acceptable Use Policy and Password Policy generators cover account and password handling.
- Use a password manager for shared logins so you can see every password a person had access to, and change only those.
Want help with the steps that need an IT provider?
Preferred Data Corporation has supported businesses from High Point, NC since 1987. These services cover the technical steps on this list.
Frequently asked questions
When should we turn off a departing employee’s access?
At the moment they stop working for you, not at the end of the week. For an involuntary departure, turn access off during the exit conversation. The FTC recommends a set check-out routine so it happens every time.
Should we delete the account right away?
Usually not. Microsoft notes that deleting an account stops email to that address from arriving, and the user's mailbox and OneDrive are kept only 30 days afterwards. Block sign-in first, move what matters, then delete.
Can we keep their email address working?
Yes. Forward it to the person taking over, or convert it to a shared mailbox that several people can open. Microsoft says a shared mailbox under 50 GB does not need a paid license, but the account must stay in place as its anchor.
What if they used their personal phone for work?
If the phone was enrolled in your device management, your IT provider can remove only the company data and apps. Microsoft notes this only works when the phone connects to the internet, so do it promptly.
Can we read a former employee’s email?
Many businesses state in a written acceptable use policy that company email and files belong to the business. If yours does not, check with your attorney before reading a former employee’s mailbox.
Sources
- FTC: Protecting Personal Information, A Guide for Business
- Microsoft Learn: Remove a former employee and secure data
- Microsoft Learn: Save the contents of a former employee’s mailbox
- Microsoft Learn: Convert a user mailbox to a shared mailbox
- Microsoft Learn: Assign or unassign licenses
- Microsoft Learn: Revoke user access in Microsoft Entra ID
- Microsoft Learn: Manage user authentication methods
Related free resources
Free toolIT Budget CalculatorPick the IT services your business needs and get a realistic monthly and yearly budget range for your size.
Free toolWebsite Health AnalyzerEnter any web address to check its speed, security settings and search basics, with a score for each.
Free toolM&A Technology Readiness AssessmentFor buyers of a business: rate the target company’s technology risk and see how hidden IT costs could change the deal math.
Policy templateIT Acceptable Use PolicySet clear rules for how employees use company computers, email, internet, software and data, and what monitoring they should expect.
Policy templateRemote Work and BYOD PolicyLet people work from home and use their own phones safely, with clear rules for home networks, device enrollment, company data and what happens when someone leaves.
Policy templateAccess Control PolicyGive people only the access they need, protect every sign-in with MFA, keep admin accounts separate, review access every quarter and remove it the moment someone leaves.
Want offboarding handled the same way every time?
Preferred Data can run the technical offboarding steps for you when someone leaves and help you build an access list for every employee, so nothing depends on memory.
Preferred Data Corporation, 1208 Eastchester Drive, Suite 131, High Point, NC 27265