IT offboarding checklist: close every access route

What to settle first

• The last working day, and whether leave comes before it.
• Who takes over tasks, the mailbox and files?
• Are there devices that need to come back, and when?
• If the departure is contentious: block access immediately, not at the end of the month.

The checklist by timing

AS SOON AS THE DEPARTURE IS KNOWN
[ ] Date, successor and handover agreed with the manager
[ ] List of all accounts drawn up (central and third-party services)
[ ] Devices noted from the inventory

LAST WEEK
[ ] Handover of files to the successor supported
[ ] Shares and memberships that should pass on noted
[ ] Return appointment for devices arranged

LAST WORKING DAY
[ ] Microsoft 365 / Entra ID account blocked
[ ] Sessions signed out, two-factor methods removed
[ ] Automatic reply or forwarding set according to policy
[ ] Devices returned, return form signed
[ ] Keys, cards and tokens returned

FIRST WEEK AFTERWARDS
[ ] Third-party services blocked: supplier portals, bank,
    social media, cloud storage, password manager
[ ] Shared passwords the person knew changed
[ ] Licences released
[ ] Phone, extension, company mobile and SIM reassigned
[ ] Devices reset, inventory updated

AFTER THE RETENTION PERIOD
[ ] Mailbox and account deleted or archived according to policy

What is most often left open

Third-party services without central sign-in

Anything that runs on an email address and its own password is not blocked when the Microsoft 365 account is blocked: supplier portals, freight forwarders, trade fair portals, the company’s social media accounts. Keep a list for each department, otherwise you will only find them after the person has left.

Shared passwords

Guest Wi-Fi, the printer’s admin login, the router at the outlying warehouse. If the person knew them, change them. A password manager with shared vaults makes this easier, because you can see who had which entries.

Forwarding rules

A rule that forwards email to a private address sometimes survives the block. Check mailbox rules before you block the account.

Two-factor authentication on a private phone

The app stays on the phone. Without the account it is useless, but remove the methods anyway so that they do not get in the way if the person is hired again.

Record who did what

In a dispute, an audit or a query from the data protection officer, you need to be able to show when access was blocked. Record the date, the time, who blocked it and which devices came back. A ticket with a checklist is better for this than an email, because the history and timestamps come automatically.

Hand over files, OneDrive and the mailbox

What the person has in their personal storage is hard to reach once the account is blocked. In the last week, agree with the manager what has to be handed over, and have the person move it to shared storage themselves. That is cleaner than IT accessing it after they have left.

There are three usual routes for the mailbox: an automatic reply with a new contact, temporary forwarding to the successor, or conversion to a shared mailbox that the successor can access. Which route is permitted in your company is something to agree beforehand with your data protection officer. It can matter whether private email was allowed.

Moves within the company

An internal move is half a departure and half a start. The person keeps the account and device but gets new permissions and has to give up the old ones. This is exactly where permissions pile up over the years, because only the new ones get set up. At a move, take the permissions list of the old role and strike out whatever is no longer needed.

Fixed-term contracts and external staff

With fixed-term contracts, you know the end date from the start. Enter it as an expiry date when you create the account. For external people with access, such as an IT service provider, the same applies to every guest access: set an end date, then check afterwards that it has really expired.

Who does what

HR

Reports the departure with the date, as early as possible.

Manager

Arranges the handover of tasks, files and the mailbox.

IT

Blocks access, collects devices, closes third-party services and documents it.

The person leaving

Returns devices, moves files and names accounts only they know about.

After they leave: questions that still come

Weeks later, someone asks about an email sent to the old address, or about a file from personal storage. If the rules were clear beforehand, the answer is simple: the email went to the successor, the file is in the shared storage, or it was deleted after the retention period. Write down the rules for the mailbox and files once and apply them the same way at every departure. That also protects you if someone asks later why something is gone.

When a departure ends in dispute

With a dismissal in dispute, the order changes. The block comes first, ideally at the very moment the conversation takes place, agreed with HR and management. After that, end sessions, check forwarding and block third-party services. Record every step with the time. Agree beforehand who takes the device and who accompanies the person. IT decides none of this. It carries it out.

Leavers as a request with a task list

If users and account status come from Entra ID, the ticketing system takes over the block from Microsoft 365. 404desk does this at the next sync, which runs every 15 minutes, and larger waves of blocks need confirmation. If access has to end immediately, also deactivate the account directly in 404desk. A leaver is set up as a request with a task list, and the return of devices goes through the inventory with a form. See requests and approvals.