Employee IT Offboarding: A Small Business Checklist

An employee’s last day creates a technology handoff as well as a staffing change. Email, shared files, business applications, phones, company devices, and automated workflows may all depend on that person’s accounts.

A useful employee IT offboarding checklist answers two questions: how will the business remove access at the approved time, and how will the team continue the work afterward?

The process should connect the manager, the person responsible for employment decisions, and IT. Sending an informal request to “delete the account” leaves important decisions unresolved.

Quick answer: what belongs in IT offboarding?

• An authorized departure time, business owner, and IT coordinator
• An inventory of accounts, devices, credentials, and physical access
• A plan to preserve required business data and assign its new owner
• Account, session, remote-access, and credential changes
• Phone, email, customer communication, and automation handoffs
• Equipment return, final checks, and a record of unresolved exceptions

Treat this as a planning checklist. The exact administrator steps depend on your identity provider, applications, device management, and approved data-retention requirements.

1. Create one authorized offboarding request

Record the employee, role, manager, final working time, and person authorized to approve the access cutoff. Specify the timezone if the team spans locations.

For a planned departure, prepare the handoff before the last day. For an urgent departure, coordinate a more immediate restriction of access with the authorized decision-makers.

Make the request specific enough to execute. “End of day” is ambiguous when payroll, the manager, and IT interpret it differently.

Avoid putting passwords or private employment details in a general support ticket. IT needs the instructions and scope required to perform the work.

2. Use the actual access inventory

Start with the employee’s IT onboarding record and the latest user access review. Then check what changed after onboarding.

Include company email, CRM, accounting, file storage, website administration, social media, advertising accounts, VPN, remote support, phone applications, password vaults, and security-system access.

Record whether each account is company-owned, vendor-managed, or connected through single sign-on. An application with its own login needs an explicit removal task; disabling the central identity should not be assumed to cover every service.

Also identify badges, keys, alarm codes, mobile devices, and any personally owned device used for business. Assign physical access changes to the appropriate property or security administrator.

3. Decide who owns the records before deletion

Ask the manager which business files, active customer conversations, project records, and calendar responsibilities need a successor. Keep access limited to the people authorized to receive that information.

Microsoft’s former-employee guidance separates blocking access from preserving email and OneDrive information, arranging handoff, removing licenses, and deleting the account. That distinction matters: account cleanup and data continuity are separate decisions.

Have the administrator verify the applicable mailbox, storage, licensing, and retention settings before taking destructive steps. Do not assume a backup, a mailbox conversion, or a fixed grace period automatically covers every business requirement.

If records are subject to a hold or other retention obligation, have the authorized owner resolve that requirement before deletion.

4. Restrict access using a coordinated sequence

Write down the sequence for your environment and assign an executor to each system.

The cutoff plan should address sign-in, active sessions, remote access, privileged identities, recovery methods, and application-specific access. Use the identity provider’s documented controls and verify what each action actually affects.

Remove the employee from shared vaults and groups. If they knew a shared password, alarm code, or recovery secret that remains in use, assess whether it needs replacement.

Avoid changing every shared credential blindly during business hours. Identify affected devices and integrations so necessary changes do not unexpectedly stop unrelated services.

5. Transfer workflows that run under the employee’s identity

A departed employee may still own a website form integration, scheduled report, cloud automation, domain renewal, or vendor portal.

List those dependencies and name the replacement owner. Confirm that the replacement account has the required authorization and that the workflow still works after the handoff.

For example, a lead form may submit successfully while its downstream CRM connection fails after the former employee’s access is removed. Test the complete path from submission to assignment, using clearly identified test data.

The handoff should preserve accountability. Avoid solving ownership problems by keeping the former employee’s login active indefinitely.

6. Keep customer communication intentional

Decide what happens to the employee’s phone extension, voicemail, email replies, bookings, and open customer requests.

Document the approved destination and review date for forwarding or delegation. A manager should own the business decision about who receives those communications.

Test a sample inbound call and email after the changes. Confirm that customers reach the intended team and that no obsolete announcement directs them to a departed employee.

7. Recover and inspect company equipment

Record serial numbers, accessories, return status, and the employee’s assigned devices. Reconcile that list with the device lifecycle record.

Save required business information through the approved process before preparing equipment for reuse. Distinguish company-owned hardware from personal hardware; apply only authorized management actions.

Check for missing devices and remove returned equipment from the departed employee’s assignment. Confirm the next owner and configuration plan rather than handing over a laptop with the previous user’s session still active.

8. Verify completion and track exceptions

Close the request with evidence of the changes, the new data and workflow owners, returned equipment, and any unresolved items.

Useful checks include a current application roster, confirmation from vendor-managed systems, and a successful test of transferred business workflows. Record when and by whom each check was performed.

A missing device or inaccessible vendor portal should remain an assigned exception with a next action. It should not disappear inside a ticket marked complete.

Employee IT offboarding FAQ

Is deleting the email account enough?

No. Email is one part of the person’s access. Review independent applications, remote access, shared credentials, devices, physical entry, and workflow ownership.

Should the business keep the old account active?

Decide the communication and data-handoff method deliberately. Do not use continued employee access as a substitute for a documented transition.

Can SMART Solutions help with the technology handoff?

SMART Solutions provides computer, server, and device support, including configuration, remote support, maintenance, and data-protection planning. Contact our team to discuss your environment and the systems that need coordination.

Source and next step

• Microsoft Learn — Remove a former employee: Microsoft 365 access restriction, data preservation, communication handoff, licensing, and account cleanup.

Prepare the checklist before the next departure. A named owner and an agreed cutoff make the process easier to execute and easier to verify.