When an employee leaves: an IT offboarding checklist for small businesses

Disabling email is only the first step. A reliable offboarding process also closes application access, protects existing sessions, preserves business records, and returns control of systems and devices to the company.

An employee's last day usually involves payroll, keys, and a conversation about unfinished work. IT access is easy to treat as one more box to check: disable the email account and collect the laptop.

That is a start, not a complete offboarding process. The employee may also have access to accounting software, shared files, a password manager, a VPN, a client portal, a remote desktop, or an application that signs in independently of company email.

The practical goal is straightforward: end access at the right time, preserve the information the business still needs, and leave a record showing what was done.

Decide who owns the departure

Offboarding works better when one person coordinates it. The owner or manager should notify whoever administers the systems, provide the employee's departure time, and identify the business records or responsibilities that need to be handed over.

For a planned departure, prepare the access list in advance. For an immediate or sensitive termination, coordinate account changes with the person managing the departure so access is removed at the agreed time. Do not rely on an employee to tell IT that they are leaving.

A small business does not need a complicated workflow. It needs a named requester, an authorized approver, an IT owner, a target time, and a completed checklist.

Make an access inventory before changing anything

Start with the primary identity account, then look outward. Check email and cloud storage, line-of-business applications, payroll and bookkeeping systems, customer databases, VPNs, remote-access tools, shared folders, phone systems, password vaults, and physical access.

Also ask whether the person administered any service. An employee may be the only person who knows the domain registrar login, owns a marketing platform, manages a vendor relationship, or receives billing and security notices. Those dependencies should be transferred before the account disappears.

For tax offices, dental practices, and other information-heavy businesses, application access is often more important than the email account. A person might lose email access yet retain a separate login to the practice-management or tax-preparation system.

Disable sign-in and address existing sessions

At the agreed departure time, block or suspend the employee's main organizational account. Then take the platform's recommended steps to revoke active sign-in sessions and other authentication methods. Changing a password alone should not be treated as proof that every session has ended.

Microsoft's former-employee guidance separates blocking sign-in from preserving mail, recovering files, handling devices, and eventually deleting the account. Its access-revocation guidance also notes that some application sessions and access tokens can remain valid for a period after revocation begins.

Google's Workspace guidance addresses password recovery, authorized application tokens, sign-in cookies, security keys, and app passwords in addition to the user account itself.

The general lesson is that blocking a new login and ending an existing session are related but different tasks. For systems that do not rely on your central identity provider, disable access directly in those systems too.

Remove privileges and shared access

Review administrative roles, group memberships, shared mailboxes, delegated access, file-sharing permissions, and access granted through teams or project groups. Some permissions are inherited from a group; others were granted directly and are easy to miss.

If the employee knew a shared password, decide whether that secret needs to be changed. This is especially important for administrative accounts, shared service credentials, building access codes, and accounts without individual logins.

Do not reset every company password by default. Identify what the departing employee actually knew or could use, then rotate the affected credentials and record the change.

Handle devices and locally stored information

Collect company laptops, phones, security keys, badges, removable drives, and any other issued equipment. Record the device, its condition, and whether it has been returned. A device inventory makes this substantially easier.

For managed devices that cannot be recovered promptly, assess whether to lock the device or remove company data remotely. Remote actions may depend on the device connecting to the internet, and wiping can destroy information that has not been preserved.

Personal devices require additional care. Where company data is managed separately, an organization may be able to remove its business profile or managed application data without erasing personal content. Confirm the available controls, company policy, and authorization before taking action.

Preserve email, files, and business continuity

Do not delete the user first and investigate later. Determine who needs access to current projects, client correspondence, calendars, shared files, and business records. Preserve what is required by company policy, contracts, and any applicable retention or legal-hold obligations.

Microsoft documents options such as mailbox conversion, email forwarding, and granting authorized access to files. Google provides options for transferring or retaining former-employee data. The right choice depends on the platform, licensing, retention requirements, and the business purpose.

A mailbox should not simply become an unmonitored forwarding rule. Assign responsibility for incoming messages, decide how long the address should remain active, and consider whether an automatic reply is more appropriate. Review any forwarding arrangements for privacy and confidentiality concerns.

Only after the business has handled retention and transfer should it decide when to remove licenses and delete the account. The sequence matters because deletion and licensing changes can affect access to retained data.

Check third-party applications and integrations

Some software uses the employee's company login; other software maintains its own account, password, or session. A few applications may have been authorized to read mail, synchronize files, or connect to financial data through an integration.

Review these separately. Remove the user's application account where appropriate, revoke unneeded tokens or connected apps, and transfer ownership of business integrations. A central account suspension may not immediately terminate sessions in every independent application.

The same discipline applies to outside providers. Our vendor-access checklist explains how to track privileged access and remove it when a relationship ends.

Do not forget financial and operational authority

IT offboarding is not only about data. A former employee might still be able to approve purchases, initiate payments, manage a payment processor, change banking details, administer a website, or communicate with customers through an official account.

Review the person's role in banking, payroll, point-of-sale systems, insurance portals, domain registration, social media, and business communication tools. Transfer account ownership where needed, and notify relevant internal staff about changes in approval authority.

For an employee who managed clients or vendors, make sure the next responsible person can see the relevant work history without needing to log in as the former employee.

Verify the work and keep a record

After the immediate changes, verify them. Confirm the primary account is blocked, the important application accounts are disabled, privileged access is removed, devices are accounted for, and the necessary business data has an assigned owner.

Document any exceptions. Perhaps a company laptop is still in transit, a vendor account needs manual closure, or a mailbox must remain retained for a defined period. Record who owns the exception and when it will be revisited.

For organizations maintaining a written information security program, the checklist and completion record can help demonstrate that access termination is an operating process rather than an informal promise. Specific regulatory obligations vary by business.

A practical offboarding checklist

Use this as a starting point, then add the applications and systems your organization actually uses:

• Confirm the departure time, approver, and IT owner.
• List company accounts, applications, devices, and privileged roles.
• Identify business records, client work, and account ownership to transfer.
• Block or suspend the primary account at the approved time.
• Revoke sessions and authentication methods as appropriate.
• Disable independent application accounts and remove unneeded integrations.
• Remove privileged, delegated, group, and remote-access permissions.
• Rotate shared credentials the employee knew or could use.
• Recover devices and assess managed-data removal where necessary.
• Preserve required email, files, and records before deletion.
• Transfer operational, financial, and vendor responsibilities.
• Verify the changes, record exceptions, and schedule follow-up.

The checklist should live where the people handling departures can find it. A process nobody can locate on the day it is needed is not much of a process.

A good departure should be uneventful

Employee offboarding should not depend on whether a particular technician remembers which systems the employee used. It should be repeatable, appropriately timed, and easy to verify.

That is part of the value of managed IT and consistent cloud account administration: access is documented while people work, so it can be removed cleanly when they leave.

For a small business, the best result is simple. The former employee no longer has access, the company retains what it needs, and ordinary operations continue without interruption.

Authoritative guidance

• Microsoft: Remove a former employee and secure data
• Microsoft: Revoke user access in Entra ID
• Google Workspace: Maintain data security after an employee leaves