IT offboarding checklist for leavers

Who this is for

This guide is for the person who owns IT offboarding at a small or mid-sized company. That might be an IT admin, an operations lead, a founder who still holds the admin passwords, or an office manager who runs the ticket queue. The common thread is that someone else is leaving and you need a repeatable way to remove their access without losing work or breaking a service.

Use it for employees, contractors, interns and anyone with a company account, even if they never got a laptop. A contractor who only has a Slack account and a shared drive login still needs a leaver record. The IT offboarding checklist for leavers should be the same document every time, with room for notes.

The checklist does not replace HR or the manager. HR sets the exit date and handles the people side. The manager owns the handover of work. IT owns accounts, devices, data access and the evidence that each step happened. Write that split down before the first leaver ticket.

Before you begin

Get the exit date and last working day in writing from HR or the manager. Confirm the exact time access should stop: usually the end of the last working day, unless there is a risk reason to cut it earlier. Put both dates on the leaver ticket, not in a chat message.

Pull a list of systems before you start. Use your SSO dashboard, your device inventory and your finance or admin tools to find apps that sit outside single sign-on. Check for shared mailboxes, distribution lists, VPN accounts, code repositories, cloud consoles and any third-party service the person uses. Add each one to the ticket so nothing depends on memory.

Find the asset record: laptop, phone, security key, badge and any loaner gear. Confirm who collects it and where it goes. Ask HR or legal to flag retention holds or mailbox rules you must keep. Tell the manager what you need from them, such as a handover document and a list of ongoing work, before the last day.

The checklist

Run the checklist in order. Identity comes first because it stops new logins while you sort out data. Devices and data come next. Shared credentials last, after you know what the leaver could reach.

The list below is the minimum for a normal leaver. A high-risk leaver, such as someone with admin rights or a public-facing role, needs the same steps done faster and with a second person checking.

Do not delete an account on day one. Disable it, move the data, keep the mailbox for the retention period, then delete. The checklist should make that sequence obvious, so nobody skips the handover.

• Open a leaver ticket with the exit date, last working day, manager name and the systems in scope.
• Set the account expiry or disable date in your identity provider, such as Entra ID, Okta or Google Workspace, to match the agreed time.
• Revoke active sessions, refresh tokens and VPN connections so the person is signed out everywhere, including mobile apps and browser sessions.
• Remove the person from groups, distribution lists, shared mailboxes and role assignments that grant access beyond their own account.
• Check that the leaver is not the only owner of a critical group, mailbox or cloud subscription before you remove access.
• Transfer ownership of files, folders, calendars and shared drives to the manager or a named colleague, then check the new owner can open them.
• Set an out of office reply and voicemail greeting where the role needs one, and route the mailbox to a monitored shared mailbox.
• Collect the laptop, phone, security key, badge and any other company hardware, and log the return against the asset tag.
• Wipe or reimage returned devices before they go back into stock, and remove the device from mobile device management and endpoint protection.
• Rotate shared credentials the leaver could see, including local admin passwords, API keys, service account passwords and password manager entries.
• Remove the person from third-party apps that use their own login, and revoke OAuth grants and API tokens tied to their account.
• Keep the mailbox and files for the retention period HR or legal confirms, then delete or archive them on a scheduled date.
• Close the ticket with evidence: screenshots of disabled accounts, asset return form, handover sign-off and the date each step was done.

What good looks like

A good offboarding run is boring. The leaver ticket has a named owner, a date and a short list of systems. Access stops at the agreed time. The manager confirms the handover in writing. The laptop comes back, gets wiped and goes into stock. The ticket closes with evidence, not a verbal yes.

You should be able to answer two questions after the fact: did the person lose access on time, and did their work move to someone who can use it with a record of the device and the data? If either answer is no, the process has a gap.

Good teams also check for orphaned accounts between leavers. Run a monthly report of accounts with no owner, no recent login, or access that does not match the person's role. That catches the contractor who left without a ticket and the service account nobody owns.

What to do next

Turn the checklist into a ticket template in your help desk. Add required fields for exit date, manager, asset tag and handover link. Make the template create sub-tasks for identity, device, data and credentials so a single person can run it without a meeting.

Run the template on the next two leavers and time each step. Fix the step that always gets skipped, usually mailbox delegation or shared password rotation. Add a second pair of eyes for admin accounts and anyone who can approve payments or change production systems.

If you want the ticket, inventory and leaver checklist built for you, Cloudverg's IT service desk setup is $6,500/month as a fixed scope. It starts within 10 business days and includes joiner, mover and leaver checklists, device and software inventory tied to people, and access request workflows. It is one option among other help desk tools or a custom build. The checklist matters more than the tool.

Frequently asked questions