An employee offboarding access checklist helps your business remove access methodically when a staff member, contractor, or temporary worker leaves. Disabling a work account is important, but access may also remain through email delegations, remote connections, shared passwords, recovery settings, and physical entry systems.
Coordinate the process among the employee’s manager, the person responsible for IT, and whoever manages the departure. For a planned exit, prepare the checklist ahead of the final work period. For an unexpected departure, coordinate access changes with the separation so accounts and entry methods are addressed promptly. Keep a record of completed actions and any follow-up items.
At departure: remove direct access
Identity, email, and account recovery
- Disable the user’s main identity account. Check the business directory and any connected identity provider, not just the computer login.
- Review email access. Remove sign-in access and check delegated mailbox permissions, forwarding rules, shared mailboxes, and any alternate email applications.
- Review recovery methods. Remove the departing person’s phone number, personal email, security key, or other recovery option from business accounts where it was used.
- Revoke active sessions and tokens. Where the service supports it, sign out existing sessions and invalidate access tokens, app passwords, or remembered devices.
- Remove multifactor authentication enrollment. Confirm the person cannot approve future sign-ins or use a registered device to regain access.
Do not delete an email account or files before deciding what business information must be retained or transferred. Preserve email and records according to your organization’s retention and continuity process, while preventing the former employee from signing in. A manager or designated colleague can receive appropriate access to business communications without keeping the former employee’s credentials active.
Business applications, files, and data
- Review the employee’s assigned applications, including file storage, collaboration tools, customer and operational systems, finance tools, and industry-specific software.
- Remove direct permissions to shared folders, project workspaces, databases, and cloud resources. Check access granted through groups as well as individual invitations.
- Transfer ownership of business files, calendars, forms, workflows, and other work materials to an appropriate owner.
- Review connected third-party applications and integrations authorized through the employee’s account. Remove connections that are no longer needed.
- Check whether the employee had administrator, billing, security, or user-management privileges. Reassign responsibilities and remove elevated access.
VPN, remote access, and active connections
Disable VPN and other remote access accounts, remote desktop tools, virtual desktops, and access used to connect to office networks or cloud environments. Check approved vendor and support tools if the employee used them. Review active sessions and saved devices in the relevant systems rather than assuming that disabling a single account ends every connection.
For a helpful overview of related safeguards, see Zevonix’s guide to cybersecurity solutions for businesses.
Review shared and elevated credentials
Named accounts are only part of the picture. A departing employee may know shared passwords, manage a password vault, or have created credentials used by applications and integrations.
- Identify shared passwords and update them when the departing person knew them or had access to the vault that stores them.
- Review password-manager membership, shared folders, emergency access, and administrative roles. Remove the user and check who can recover or administer the vault.
- Inventory API keys, application secrets, service credentials, and certificates the employee created, stored, or managed. Rotate or revoke those that may be exposed, after checking dependencies and planning the change.
- Update recovery codes and shared account recovery details when they were accessible to the departing person.
- Confirm that a current employee is responsible for any service account or integration the person maintained. Avoid changing a credential without understanding what depends on it.
Security programs with formal access-control requirements may find the NIST Special Publication 800-171 Revision 3 useful as a reference. Apply your organization’s policies and requirements when deciding how to manage accounts and records.
Collect devices and remove physical access
Make a return plan for company laptops, phones, tablets, storage media, security keys, and other assigned equipment. Also check for keys, badges, access cards, parking credentials, alarm codes, and permissions in building-entry systems. Remove access from door or visitor systems and update shared codes if the departing person knew them.
If the employee used a personal device for work, identify which business accounts and data were accessible from it. Remove business access and handle company data through your approved process. Avoid deleting personal content or wiping a personal device without the appropriate authorization and safeguards.
In healthcare organizations, include systems and locations that may provide access to ePHI, as well as relevant facility access. Coordinate these steps with the people responsible for the organization’s privacy, security, and compliance processes.
Follow up and confirm access is removed
Offboarding is not complete just because the initial account changes are done. Use an account inventory or access list to check that each system has an owner and a recorded outcome. Then verify the following:
- The former employee’s direct accounts are disabled, and assigned access has been removed from shared systems.
- Email forwarding, delegated access, active sessions, connected applications, and recovery methods have been reviewed.
- Shared and elevated credentials have been assessed, with necessary changes completed in a controlled way.
- Files, mail, and business records have an appropriate owner and remain available to authorized staff.
- Company equipment and physical credentials have been returned or deactivated, and any outstanding items have an assigned follow-up owner.
- Relevant account or access logs have been reviewed when appropriate to your process, and completed actions are documented.
Keep the checklist usable for contractors and temporary workers too. Their access may be limited to one project or application, but those accounts, invitations, devices, and physical permissions still need a clear end point.
A periodic review of account inventories can make departures easier to manage by revealing stale accounts and unclear ownership before they become urgent. Zevonix’s guide to cybersecurity audits offers more context on reviewing business security practices.
Frequently asked questions
When should a business revoke an employee’s access?
Coordinate access changes with the departure. For a planned exit, prepare in advance and remove access at the appropriate point in the employee’s final work period. For an unexpected departure, coordinate prompt access removal with the people managing the separation.
Should a former employee’s email account be deleted?
Not necessarily. Preserve and transfer business email or records as your organization’s retention and continuity process requires, but remove the former employee’s ability to sign in.
What should a business do about company data on a personal device?
Identify the business accounts and data involved, remove business access through an approved process, and take care not to delete personal content without authorization.
Does the checklist apply to contractors and temporary workers?
Yes. Review the accounts, shared resources, devices, and physical access they received, then disable or transfer those permissions when the work ends.
Make offboarding a repeatable security step
A consistent process helps your team revoke access without losing track of records, credentials, equipment, or physical entry. Zevonix provides business IT support in St. Augustine and surrounding areas, including cybersecurity and proactive monitoring. If you want help reviewing your offboarding process, get in touch with the team to discuss your needs.