When someone leaves your business, HR handles the paperwork. The IT side is easier to miss: the email account that still works, the laptop that never came back, the shared password they knew. Months later, those are the gaps an insurer or auditor finds.
Here’s a checklist to run every time, whether the departure is friendly or not.
Before their last day
- Tell your MSP/IT provider the date and time access should end.
- Decide who takes over their email, files and open work.
- List the devices they have: laptop, phone, tablet, security key, building access card.
When access ends
- Disable the account in Microsoft 365 or Google Workspace, rather than deleting it straight away, so mail and files can be handed over.
- Sign them out everywhere, including phones and web sessions.
- Remove MFA devices tied to the account.
- Revoke remote access: VPN, remote desktop and any cloud apps they used.
- Change shared passwords they knew, such as Wi-Fi, alarm codes or a shared vendor login.
- Forward or share their mailbox with whoever is taking over.
Devices and data
- Collect company devices and check them off the list.
- Wipe and reissue laptops, or keep them as they are if there’s a legal or HR reason to.
- Remove company data from personal phones that had email or apps installed.
Afterward
- Check line-of-business apps, vendor portals and social media for accounts that weren’t on the main list.
- Remove their licenses so you’re not paying for an empty seat.
- Write down what was done and when. That record is what an auditor will ask for.
How we handle it
At ITAssurance℠, offboarding is part of managed IT: when staff leave, we remove their access to the accounts and systems we manage.
Frequently asked questions
What should IT do when an employee leaves?
Disable their accounts, sign them out of every device and session, remove their MFA devices, revoke remote access, change any shared passwords they knew, hand their mailbox and files to whoever takes over, collect company devices and remove company data from personal phones.
Should we delete a former employee's account?
Usually not straight away. Disabling the account stops access while keeping email and files available to hand over. Once the handover is done and any retention needs are met, the account can be removed and its license freed up.
Why keep a record of offboarding?
Insurers, auditors and clients often ask what happened to a former employee's access and when. A short record of what was disabled, collected and changed answers that question quickly, and shows the steps weren't skipped.
See what’s included in ITAssurance managed IT.
General information for business owners. It isn’t legal, compliance or insurance advice for your specific situation.
