Employee Departure Security Checklist: 40 Steps for a Clean, Verifiable Offboarding

A disabled email account is only one part of offboarding. Use this coordinated checklist to revoke sessions, remove cloud and vendor access, recover devices and keys, preserve business records, transfer ownership, and verify closure.

Offboarding is an access-control event, not merely an HR form

When an employee or contractor leaves, the organization must coordinate people, accounts, sessions, devices, physical access, business records, vendors, and ongoing work. Disabling one mailbox does not end access to locally stored files, third-party applications, remembered browser sessions, shared passwords, mobile devices, door codes, social-media accounts, or vendor portals.

CISA’s Cybersecurity Performance Goals call for a defined process that revokes physical credentials and disables user accounts and organizational access by the day of departure. NIST SP 800-171 Revision 3 calls for terminating system access, revoking authenticators and credentials, retrieving security-related property, and reviewing access when personnel transfer. Microsoft explains that access tokens, refresh tokens, application sessions, and managed devices require different actions and may not all end at the same moment.

The checklist below is designed for a Central Florida small or midsize organization to adapt with human resources, legal counsel, management, IT, security, facilities, payroll, and records owners. It is not a directive to delete information or inspect personal accounts. Employment law, litigation holds, privacy, union agreements, contracts, licensing, and sector rules may change the correct sequence. Obtain appropriate advice and preserve evidence when misconduct or compromise is suspected.

Assign three facts before any action

Every offboarding record should begin with:

**Effective access cutoff:** the exact date, time, and time zone when access must end.
**Risk level:** routine, expedited, or high-risk/involuntary, with the reason restricted to authorized personnel.
**Coordinator:** the person responsible for confirming that every assigned task is completed and evidenced.

For a planned routine departure, IT may prepare transfers in advance and execute access changes at the approved time. For a high-risk or involuntary separation, HR, legal, management, facilities, and IT may need a tightly controlled sequence so access is disabled immediately before or during notification. The Interagency Security Committee guide emphasizes coordination and risk assessment for adverse separations.

Do not notify the departing person through an automated ticket or calendar invitation before the authorized communication. Limit the offboarding plan to those who need it.

Phase 1: Prepare before the final day

Governance and ownership

[ ] Record the employee’s legal name, preferred name, usernames, department, manager, location, employment type, final work time, and coordinator.
[ ] Confirm whether the change is termination, resignation, retirement, contract end, leave, or internal transfer.
[ ] Assign routine, expedited, or high-risk handling with HR, legal, management, and security input as appropriate.
[ ] Identify litigation holds, investigations, regulatory duties, contractual restrictions, or evidence-preservation requirements before changing or deleting data.
[ ] Establish who may communicate with the employee, customers, vendors, partners, and coworkers.
[ ] Define who will approve mailbox, file, phone, social-media, and customer-record transfers.

Access inventory

[ ] Export or reconcile all assigned accounts, roles, groups, licenses, devices, keys, badges, tokens, certificates, and remote-access methods.
[ ] Include Microsoft 365 or other identity platforms, local directories, VPN, password managers, cloud services, line-of-business systems, accounting, payroll, CRM, website, domain, social media, marketing, code repositories, developer platforms, support tools, physical security, and vendor portals.
[ ] Identify accounts that use direct sign-in rather than the organization’s single sign-on.
[ ] Identify shared accounts, shared passwords, API keys, application passwords, service accounts, automation, and integrations known to the employee.
[ ] Identify elevated privileges, delegated mailbox access, application ownership, approval authority, and emergency roles.

Business continuity

[ ] Transfer ownership of active projects, customer relationships, tickets, calendars, recurring meetings, approvals, scheduled reports, and vendor contacts.
[ ] Identify business records stored only in personal folders, local devices, personal cloud storage, or an individual mailbox, following authorized procedures.
[ ] Reassign ownership of shared files, forms, workflows, dashboards, automations, distribution groups, Teams or equivalent workspaces, websites, and applications.
[ ] Document critical knowledge and recovery information without asking the employee to disclose personal passwords.

Phase 2: Execute at the approved cutoff time

Identity and sessions

[ ] Disable the primary directory or cloud identity according to current platform guidance.
[ ] Revoke active sessions, refresh tokens, remembered sign-ins, and application sessions where supported.
[ ] Reset the organizational password to a random value through an approved administrative process; do not reuse a known temporary password.
[ ] Remove or disable registered authentication methods, security keys, app passwords, recovery contacts, and delegated authentication as appropriate.
[ ] Disable or remove registered devices and corporate access from mobile applications according to device-management policy.
[ ] Block remote access, VPN, virtual desktop, remote support, and administrative gateways.
[ ] Remove privileged roles, group memberships, delegated permissions, and emergency access.

Microsoft cautions that disabling an identity does not necessarily invalidate every application-issued session immediately. Applications that maintain their own sessions may require separate deprovisioning. Confirm the behavior of critical applications rather than assuming the central identity action reaches everything.

Independent cloud and vendor accounts

[ ] Disable direct accounts in applications that do not use centralized provisioning.
[ ] Revoke sessions in customer, vendor, financial, payment, payroll, benefits, travel, shipping, support, marketing, and social-media platforms.
[ ] Remove the person from vendor support authorization lists and verbal passphrases.
[ ] Transfer account ownership before removing the old owner when the platform requires a successor.
[ ] Revoke developer tokens, personal access tokens, SSH keys, API keys, code-signing access, and repository permissions.

Physical access and property

[ ] Disable badges, mobile credentials, door codes, parking access, alarm codes, lockbox access, and visitor-system privileges.
[ ] Recover laptops, desktops, phones, tablets, removable media, security keys, smartcards, keys, badges, payment devices, tools, uniforms, manuals, and records.
[ ] Record serial numbers and condition at return; preserve the chain of custody if an investigation may occur.
[ ] Remove access to shared vehicles, equipment, storage, mailrooms, server rooms, and restricted work areas.

For remote employees, arrange tracked return shipping and define how access and local data will be protected while equipment is in transit. Central Florida hurricane or evacuation conditions may affect shipping and facility access; do not leave the timing ambiguous.

Phase 3: Preserve, transfer, and secure information

Mail, files, and records

[ ] Apply authorized retention, legal hold, archive, or preservation before deleting accounts or data.
[ ] Grant a named successor access only to business records needed for legitimate operations.
[ ] Configure appropriate mailbox handling, such as a limited automatic reply or controlled forwarding, after privacy and security review.
[ ] Remove personal or excessive access from shared folders and records while maintaining required business continuity.
[ ] Preserve logs, messages, audit records, and device evidence if compromise, fraud, harassment, theft, or policy violation is suspected.

Do not simply forward all email to a manager indefinitely. Mailboxes may contain personal, privileged, health, employment, or unrelated information. Define purpose, duration, access, and review with authorized stakeholders.

Shared secrets and trusted relationships

[ ] Rotate passwords for any legitimate shared account the person knew.
[ ] Rotate Wi‑Fi credentials, alarm codes, door codes, lockbox combinations, vendor passphrases, encryption keys, API secrets, and certificates where exposure warrants it.
[ ] Remove the person from password-manager vaults and review exported or offline-copy risk.
[ ] Review mailbox delegates, forwarding rules, shared mailboxes, calendar delegates, and send-as permissions.
[ ] Review OAuth application consent, connected applications, browser extensions, and automation created or owned by the user.

Rotation should be risk-based and coordinated. Changing a service-account secret without updating dependent systems may interrupt operations. Document dependencies and execute through change control.

Phase 4: Inspect for persistence and unusual activity

For routine departures, perform a proportionate review. For suspicious or high-risk cases, coordinate with counsel and qualified responders before making changes that could destroy evidence.

[ ] Review recent sign-ins, locations, devices, authentication changes, and failed access.
[ ] Review creation of new users, administrator roles, API keys, forwarding rules, inbox rules, sharing links, and application consent.
[ ] Review unusual downloads, exports, deletions, cloud synchronization, removable-media use, or large transfers within authorized legal and privacy boundaries.
[ ] Review changes to payment instructions, vendor records, payroll, domains, DNS, websites, repositories, backups, and security controls.
[ ] Confirm that monitoring and alerting remain active after the account is disabled.
[ ] Escalate findings through the incident-response process; do not treat a suspected compromise as ordinary HR offboarding.

The objective is not to presume wrongdoing. It is to verify that access ended as intended and to respond appropriately to evidence.

Phase 5: Verify closure within 24 hours

[ ] Test that primary, cloud, VPN, remote, and critical application sign-ins fail.
[ ] Confirm sessions were revoked and managed devices are disabled, wiped, or recovered according to policy.
[ ] Confirm physical credentials and codes no longer work.
[ ] Confirm all property is returned or an exception is assigned with a due date.
[ ] Confirm successor ownership for critical files, mailboxes, automations, websites, vendors, and customer work.
[ ] Confirm licenses are reclaimed only after retention, transfer, and operational needs are satisfied.
[ ] Confirm every manual application has an owner and completion evidence.
[ ] Record unresolved items, risk, owner, deadline, and escalation.

A ticket marked closed is not evidence that access ended. Retain platform confirmations, account reports, device records, and test results according to policy.

Phase 6: Review again after seven and thirty days

Seven-day review

[ ] Check for failed sign-ins, attempts from old devices, unexpected forwarding, recreated access, or vendor contact.
[ ] Confirm returned equipment has been assessed, backed up or preserved where authorized, securely wiped, reconfigured, and reassigned through the asset process.
[ ] Confirm no workflow, integration, scheduled task, certificate, or application broke because it depended on the former user.
[ ] Remove temporary manager access that is no longer needed.

Thirty-day review

[ ] Confirm retention, mailbox, forwarding, automatic reply, and license decisions remain appropriate.
[ ] Confirm all exceptions and property recovery actions are resolved.
[ ] Review lessons learned and update onboarding, access inventory, and offboarding procedures.
[ ] Report completion metrics and recurring gaps to leadership.

Special checklist for administrators and high-impact roles

People with administrator, finance, payroll, HR, development, security, executive, or payment authority require expanded review:

[ ] Inventory all privileged identities, including separate admin accounts and emergency roles.
[ ] Review privileged access in cloud, network, firewall, backup, hypervisor, domain, endpoint, security, website, DNS, and vendor platforms.
[ ] Rotate credentials for consoles, appliances, service accounts, and shared emergency access the person could retrieve.
[ ] Review scripts, scheduled tasks, automation accounts, code repositories, deployment keys, certificates, and secrets.
[ ] Review payment approvals, bank access, purchasing cards, tax portals, and vendor-change authority.
[ ] Verify backup deletion, retention, restore, and encryption-key access.
[ ] Confirm monitoring covers attempts to use old privileged credentials.

Do not delete a privileged account before preserving necessary logs, ownership, and configuration information. Disable and investigate first according to policy and current platform guidance.

Internal transfers need offboarding too

A promotion or department transfer can accumulate access just as a departure can leave it behind. NIST SP 800-171 calls for reviewing physical and logical access when personnel are reassigned or transferred.

[ ] Compare old-role access with the new role’s approved access.
[ ] Remove old groups, applications, files, facilities, vendor portals, and delegated permissions that are no longer needed.
[ ] Change approval authority, ownership, and separation-of-duties assignments.
[ ] Recover old keys, devices, uniforms, tokens, or cards and issue replacements as required.
[ ] Verify completion with the former and new managers.

“Keep everything just in case” creates privilege accumulation and weakens accountability.

Microsoft 365 and Entra considerations

Microsoft’s current documentation distinguishes blocking sign-in, revoking refresh tokens and sessions, disabling devices, controlling email access, and deprovisioning applications. The correct workflow depends on whether the organization is cloud-only, hybrid, or federated and on the licenses and services in use.

A tailored Microsoft checklist may include:

Block sign-in at the authoritative identity source.
Revoke sign-in sessions and refresh tokens.
Disable or retire registered and managed devices.
Remove privileged roles, group memberships, and delegated access.
Review mailbox forwarding, inbox rules, delegates, mobile access, and connected applications.
Transfer OneDrive, SharePoint, Teams, Power Platform, application, and group ownership.
Preserve and grant access to business records according to retention and legal requirements.
Deprovision the user from applications that maintain their own identities or sessions.

Follow current Microsoft instructions rather than copying commands from an old checklist. Test the organization’s process using a nonproduction or controlled account so administrators understand timing and dependencies.

A one-page completion record

For each departure, retain a concise record containing:

Employee or contractor identifier and role.
Effective cutoff time and risk level.
HR, manager, IT, facilities, and coordinator approvals.
Identity, application, device, and physical-access actions.
Property returned and exceptions.
Records preserved and ownership transfers.
Verification tests and results.
Suspicious findings or incident reference, with access restricted appropriately.
Open actions, owners, and deadlines.
Seven-day and thirty-day review results.

Avoid placing unnecessary sensitive HR details in a broadly accessible IT ticket. Separate access-control evidence from restricted employment records while retaining a reliable link between them.

Metrics that reveal process health

Leadership can review:

Percentage of departures communicated before the cutoff time.
Percentage completed by the approved cutoff.
Average number of manual application accounts discovered.
Property-return exceptions.
Dormant or former-worker accounts found during audits.
Transfers with excessive old-role access.
Failed session-revocation or device-control actions.
Repeated gaps by system, vendor, or department.
Corrective actions completed by the next review.

The goal is not speed alone. A fast process that deletes required records, breaks critical automation, or misses direct cloud accounts is not successful. Measure timeliness, completeness, evidence, and business continuity together.

Final rule: no departure is complete until it is verified

Offboarding should produce an answer to four questions:

1. Has logical and physical access ended at the approved time?

2. Has organizational property and information been recovered or protected?

3. Can the business continue without undocumented dependence on the former worker?

4. Is there evidence that the actions worked and unresolved risks are owned?

A repeatable checklist turns those questions into coordinated action. Review it whenever the organization adds a new cloud service, office, access system, vendor, or remote-work method.

Human-reviewed draft. This checklist provides general information, not legal, human-resources, labor, privacy, records-management, forensic, or product-configuration advice. Coordinate with authorized stakeholders and verify current platform guidance before acting.