Employee Offboarding Security Checklist (IT and Access)

Q: Employee Offboarding Security Checklist (IT and Access)

Disable the person's identity-provider account first, then revoke active sessions and tokens, recover or remotely lock their devices, rotate any shared passwords and API keys they could access, transfer their data ownership, and record every step so you can prove access was removed.

Why offboarding is a security problem#

Former employees’ accounts are a quiet but common source of incidents. Accounts that stay active after someone leaves can be misused by the former employee, or taken over by an attacker who finds the password in a breach dump, and nobody notices because nobody is using the account. SOC 2, ISO 27001 and most cyber-insurance questionnaires also ask you to show that access is removed promptly.

The fix is not heroics. It is a repeatable checklist that starts from the moment HR records the departure.

The checklist#

Before the last day

Confirm the departure date and time with HR, and whether the exit is voluntary or not. For involuntary exits, remove access at the same time the person is told.
List what the person has access to: identity provider groups, SaaS admin roles, cloud consoles, code repositories, shared vaults, VPN, and physical badges.
Identify data and assets they own: shared drives, documents, calendars, domains, social accounts, vendor accounts in their name.

At the moment of departure

Disable the identity-provider account (Microsoft Entra ID, Google Workspace, Okta). With SSO in place this cuts off most apps at once.
Revoke active sessions and refresh tokens. Disabling a password doesn’t always end sessions that are already open. Sign the user out everywhere.
Remove MFA methods and registered devices so the account can’t be re-enabled with an old phone.
Disable accounts in apps that don’t use SSO. These are the ones most often missed.
Lock or wipe company devices remotely through your device management (MDM) tool if they haven’t been returned.
Revoke VPN, remote access and physical badges.

Within 24 to 72 hours

Rotate shared secrets the person could see: shared passwords in team vaults, Wi-Fi keys, service accounts and API keys.
Transfer ownership of files, mailboxes, calendars, repositories and cloud resources.
Set up mail forwarding or an auto-reply for a limited period, then close the mailbox according to your retention policy.
Review recent activity for unusual downloads, forwarding rules or new OAuth app consents in the weeks before departure.
Recover hardware and reimage it before reissuing.

Afterwards

Record every step with a timestamp. This is your audit evidence.
Run a quarterly access review to catch accounts that slipped through.

How to automate it#

Offboarding goes wrong when it depends on someone remembering thirty steps across ten admin consoles. Three things make it reliable:

SSO for as many apps as possible, so disabling one account removes most access.
SCIM provisioning, so app accounts are created and removed automatically from the identity provider.
HR-driven workflows, so marking someone as departed in the HR system triggers identity, device and app changes without a manual ticket.

Platforms that combine HR, identity and device management, such as Rippling, are built around that last point. See Rippling device management →

Common mistakes#

Disabling the email account but leaving SaaS apps that use separate logins.
Forgetting personal API tokens, SSH keys and OAuth grants.
Leaving the former employee as the only owner of a domain, cloud account or vendor contract.
Never rotating the shared passwords they knew.

This page is general information, not legal or HR advice. Some links are affiliate links. We may earn a commission at no extra cost to you.