IT Offboarding Checklist: What to Do When an Employee Leaves

When someone leaves your business, the clock starts immediately. Every hour their accounts stay active is a window of exposure. The BetterCloud 2026 State of SaaS Report found that 18% of enterprises suffered a data breach tied to an un-offboarded ex-user in the past year. That number isn't from companies with no security posture. It's from companies that thought they handled it.

The problem isn't usually malice. It's that most businesses treat offboarding as an HR task. The exit interview, the final paycheck, collecting the laptop. The IT piece gets done partially, at some point, by whoever has bandwidth. Steps get skipped. Apps get overlooked. Accounts sit open for days or weeks.

Here's the full sequence.

Why Offboarding Is Harder Than It Looks

The average organization runs over 100 SaaS applications. When IT disables the SSO account (the central login that connects the major tools), it closes roughly 15 to 20 apps. Another 15 to 30 apps the employee registered with their work email stay fully active. And 10 to 20 shadow SaaS tools the employee signed up for independently aren't even on IT's radar.

That means disabling SSO closes maybe 20% to 30% of the actual access. The rest stays open.

Only 27% of organizations automate offboarding at all, per BetterCloud. For the other 73%, it's a manual checklist that gets run when someone has time. A Beyond Identity study found 83% of former employees can still access accounts from previous employers after leaving. That's not a technology failure. It's a process failure.

The IT Offboarding Checklist

Work through this in order for involuntary terminations. For voluntary departures with a notice period, start reducing access during the notice period and complete everything on the final day.

Step 1: Disable the identity provider account

Your identity provider (Microsoft Entra ID, Okta, Google Workspace) is the first step, not the last. Disabling the account here blocks new authentications across connected apps. For Microsoft 365, it also triggers Continuous Access Evaluation, which forces re-authentication in Exchange, SharePoint, and Teams within about 15 minutes.

For involuntary terminations: do this at the start of the termination conversation. Not after. Not at the end of the day.

Step 2: Revoke active sessions separately

Disabling the account stops new logins. It does not kill existing sessions. Access tokens in Entra ID have a default lifetime of 60 to 90 minutes; refresh tokens can extend that window to 24 hours or longer for persistent sessions. A former employee with an active Salesforce or GitHub session can keep working in it for hours after their account is technically "disabled."

Revoke all refresh tokens explicitly. In Entra, that's a separate action from disabling the account (use the "Revoke Sign-In Sessions" option or the Graph API). For individual SaaS tools, force session termination at the app level where available.

Step 3: Close SaaS accounts not behind SSO

This is where most offboarding processes fail. Not every app the employee used is connected to your identity provider. Go through every tool they accessed and check for direct accounts:

• Design tools and productivity apps signed up with their work email
• AI tools and writing assistants
• Scheduling, communication, and file-sharing apps
• Any subscriptions on the corporate card tied to their name or email

Each one needs a manual account closure, separate from SSO revocation.

Step 4: Revoke API tokens, PATs, and SSH keys

Developers and IT staff generate credentials that outlive their employment entirely. GitHub personal access tokens have no built-in expiry and survive any identity provider action. AWS access keys, Slack user tokens, SSH keys, and service account credentials all fall in the same category.

An active API key gives the same access the employee had on their last day, running silently in the background. Review code repositories, CI/CD pipelines, and integration platforms for credentials tied to the departing employee. Revoke or rotate every one.

Step 5: Transfer file and data ownership first

In Google Workspace, deleting a user without transferring their Drive files first permanently destroys those documents. In Microsoft 365, OneDrive data is retained for 93 days after deletion, but only if you know to preserve it before the account is removed.

Assign a successor for the employee's mailbox, files, shared drives, and any workspaces or channels they own. Transfer ownership first. Then disable or close accounts. The order matters.

Step 6: Retrieve and wipe hardware

Laptops, phones, tablets, docking stations, external drives, hardware security keys (YubiKeys count here), office access cards. Cross-reference your asset inventory against what you actually collect. Remote employees frequently have equipment that was never properly logged.

Wipe or re-image devices before reassigning them.

Step 7: Rotate shared credentials

Any password the employee knew needs to rotate. Shared logins, Wi-Fi passwords, alarm codes, service account credentials, vendor portal passwords. This is easy to defer and easy to forget. Put it on the checklist so it happens before the former employee has any reason to use it.

Step 8: Handle the mailbox

Forward email to the employee's manager or successor. Set an auto-reply. Remove the former employee from all distribution lists, internal Slack channels, shared calendars, and any group they were still a member of.

A former employee left on an internal channel continues receiving confidential business conversations. It happens routinely, usually because no one got around to removing them.

Step 9: Document everything with timestamps

Keep a record of every step: account disabled, sessions revoked, apps closed, hardware retrieved. SOC 2, HIPAA, and ISO 27001 all require documented access termination. "We disabled the account" and "here's the log showing exactly when and what was revoked" are very different answers in an audit or an incident investigation.

The AI Agent Problem Worth Knowing About

Employees building workflows in tools like Copilot Studio, Make, or n8n create automated agents that run on their saved credentials. When they leave, those agents keep running: pulling data from Salesforce on a schedule, forwarding files, triggering automations. The employee is gone. The pipeline isn't.

This is one of the newer gaps in offboarding. If you've got staff using AI tools that connect to business systems, add agent inventory to your offboarding checklist. Identify every agent built by the departing employee, transfer ownership or disable them, and do it before revoking their credentials, not after.

Timing: Voluntary vs. Involuntary Departures

For voluntary departures with a two-week notice period, reduce privileges during the notice period rather than cutting everything immediately. Remove admin rights, restrict access to sensitive systems the employee no longer needs for transition work, and monitor file-download activity. Then complete the full checklist on the final day.

For involuntary terminations, disable the identity provider account at the start of the termination conversation. The gap between "they were told" and "access was cut" is where the risk lives. That 18% breach figure from BetterCloud isn't theory.

Frequently Asked Questions

How quickly should we revoke IT access when someone leaves?

For involuntary terminations, access should be disabled at the start of the termination conversation. For voluntary departures, reduce privileges during the notice period and complete full revocation on the final day. Same-day revocation for critical or privileged accounts is the standard security expectation.

Does disabling SSO remove all access?

No. SSO revocation closes connected apps, but active sessions in those apps can persist for hours afterward. SaaS tools not behind SSO stay fully active. API tokens, OAuth grants, and credentials embedded in automations are not affected at all. SSO revocation is the first step in a longer sequence, not the whole thing.

What about remote employees?

The same checklist applies. Remote employees often have more independently configured SaaS tools and additional access vectors like VPN credentials and remote desktop access. Hardware retrieval requires arranged shipping or a local drop-off. Budget extra time for the SaaS audit given how much remote workers tend to set up independently.

How do we handle a shared password the former employee knew?

Rotate it immediately. Any shared login, Wi-Fi password, or service account credential the employee knew is a live backdoor until it's changed. Put this on the same-day checklist.

Who owns the offboarding process?

IT owns the technical steps. HR provides the trigger. The gap between "HR confirmed the departure" and "IT was notified" is where most delays happen. A direct real-time handoff from HR to IT, not a ticket submitted whenever HR gets around to it, is what makes prompt revocation achievable in practice.