An employee offboarding checklist for technology access helps prevent a departing team member from retaining a route into business systems, while ensuring important work records remain available. Email is only one part of the picture. Files, devices, administrator permissions, third-party apps, remote access, and shared credentials all deserve attention.
The process works best when responsibilities are clear. Human resources or a manager should notify IT of the departure and confirm the employee’s final work time. IT or a managed service provider can then coordinate access changes, device collection, and verification. For a growing business, documenting the process makes it easier to repeat without relying on memory.
Before the employee’s final work time
Start by identifying what the person can access and what the business needs to retain. Ask the manager to identify active projects, important files, customer or vendor communications, and systems the employee owns or administers. Make a record of assigned devices and any company credentials or physical access items they hold.
- Confirm timing: Agree on when access should end and who will initiate each change. If the departure is unexpected, coordinate promptly with the appropriate business decision-makers.
- Identify responsibilities: Name an owner for HR or management, IT, the employee’s work handoff, and final completion checks.
- Build an access inventory: Check the company directory, password manager, device-management tools, software subscriptions, and manager records. Ask about apps the employee may have set up independently.
- Plan for continuity: Decide which business files, email, calendars, and work items need to be transferred or preserved under the organization’s retention process.
Employee offboarding checklist: access to review
Email and identity accounts
Disable the employee’s sign-in at the agreed time, including the central work identity used to reach connected services. Review email, calendar, contacts, and any forwarding or delegation arrangements. Revoke active sessions and refresh or remove authentication methods associated with the departing person, as appropriate for your systems.
Do not treat account deletion as the same task as shutting off access. Preserve or transfer business email and records when needed, then follow the organization’s retention and account-removal process. Microsoft’s guide explains options for removing a former employee and securing data. Google Workspace administrators can also review guidance on archiving former employee accounts.
Shared files and collaboration spaces
Review cloud storage, shared folders, project workspaces, chat, calendars, and document collaboration tools. Transfer ownership of business files and shared resources to an appropriate remaining employee or team account. Check whether links or permissions grant access outside the organization, and remove the departing person’s access where it is no longer needed.
Before deleting an account or workspace, confirm that important records have been preserved and that colleagues can still reach the materials needed to continue work. If your business is reviewing how it protects stored information, see these cloud backup considerations.
Company devices and remote access
Collect company-owned laptops, phones, tablets, storage devices, security keys, and any other assigned equipment. Record what was returned and check that company data is handled according to your device and retention procedures. Remove the device from approved access where needed. If a device is missing, raise that promptly with the person responsible for security.
Review remote access as well as office access. That can include virtual private network accounts, remote desktop tools, management portals, and saved connections. A disabled email account alone may not close every route into company systems. For practical context on account protections, read about what to check when a business account may be compromised.
Administrator permissions and shared credentials
Check whether the departing employee has elevated permissions in email, cloud platforms, network equipment, security tools, backups, websites, or business applications. Remove or reassign those permissions, and verify that at least one appropriate business owner retains access to essential systems.
If the employee knew shared passwords or managed credentials, update them where appropriate and update the company password manager. Also review recovery email addresses, authentication methods, service accounts, and integration credentials the employee may have set up or controlled. Keep any replacement credentials in the approved company system rather than circulating them informally. CISA recommends requiring multifactor authentication as part of securing business accounts.
Third-party apps and less-visible accounts
Look beyond the tools IT directly manages. Review accounting, customer management, file sharing, design, scheduling, communication, and other business applications the employee used. Check app inventories, expense records, password-manager entries, and project documentation. Ask the manager and employee, where appropriate, about tools that may not appear in a central inventory.
For each system, determine whether to disable the individual login, transfer ownership, remove connected sign-ins, or change a shared credential. Pay particular attention to applications where the employee was the sole administrator or billing contact. Record the action taken and who verified it.
Physical access and business communications
Collect keys, badges, entry cards, and other company access items. Remove access to physical spaces where applicable. Decide how incoming email, calls, and customer requests will be handled so business communication does not disappear with the employee’s account. Use an approved delegation or routing approach rather than sharing the former employee’s password.
Verify the work and document completion
After access changes are made, have a responsible person review the checklist and confirm that each relevant system was addressed. Check that the employee cannot sign in to the main identity, key applications, remote access, and administrator tools. Confirm that transferred files and business communications are available to their new owners.
Keep a record of the completion date, systems reviewed, account or device actions, unresolved items, and the person who verified them. A short, repeatable record helps managers and IT teams spot omissions and improve the process as the business adds people and applications. For broader security planning, Zevonix has also outlined ways to improve cybersecurity for small businesses.
Frequently asked questions
When should a former employee’s email and account access be disabled?
Coordinate the timing with the appropriate business decision-makers and IT, then disable access at the agreed time. For an unplanned departure, address access promptly while preserving records the business needs.
Should you delete a former employee’s email account?
Not necessarily as the first step. Disable access, preserve or transfer business records as needed, and then follow your organization’s retention and account-removal process.
How can you find every account and app an employee could access?
Review central identity and app inventories, password-manager records, device and remote-access tools, software or expense records, and manager documentation. Ask about apps or accounts the employee created or administered outside central IT.
What should happen to a departing employee’s laptop and phone?
Collect company-owned devices, document their return, and handle business data under your organization’s device and retention procedures. Remove device access where appropriate before reassigning or preparing equipment for another user.
Close access carefully, preserve what the business needs
A well-run employee offboarding checklist closes access across identities, files, devices, privileges, and apps without losing important work records. Assign an owner, verify each step, and keep a record of completion. If your growing business needs help coordinating IT access and support, consider speaking with Zevonix about its managed IT services.