Departure details
- Employee name
- Role / department
- Manager
IT Offboarding Checklist
Offboarding fails in the gaps: the SaaS tool bought on a card that is not in your identity provider, the personal device nobody logged, the shared mailbox still forwarding. This checklist is ordered by risk and by clock, so the things that must happen inside the hour are not sitting below the laptop return.
What you get
- Tasks ordered by deadline: within the hour, same day, within a week
- Different timing for resignation, termination, and privileged-user departures
- A non-federated systems section, where misses actually happen
- An evidence block that satisfies an access-review or audit sample
How to use this template
- 1
Start from the identity provider, then work outwards. Disabling the IdP account kills federated access in one action and buys you time for everything else. Disable rather than delete. Deleting first can orphan file ownership, break shared drives, and destroy mailbox access you still need.
- 2
Keep a standing list of what is not federated. This is where offboarding leaks. Anything bought on a card, any tool with local accounts, anything with its own password: VPN appliances, network gear, database users, API keys, the domain registrar. Maintain this list continuously. Assembling it on someone's last day guarantees misses.
- 3
Match timing to the departure type. A resignation with four weeks' notice can follow a calm sequence. An involuntary termination needs access cut at or just before the conversation. A departing administrator needs credential rotation on every shared secret they knew, which is work that does not appear on a normal checklist.
- 4
Record the evidence as you go. Timestamp each revocation in the ticket. When an auditor samples a leaver, the question is when access was removed relative to the departure date, and a ticket with timestamps answers it in seconds instead of an afternoon of log archaeology.
What's inside
Here's a preview. Unlock the free download to get all 8 sections (7 more below).
Related templates
More free templates IT teams use alongside this one.
Employee IT Lifecycle
Get templateIT Onboarding & Provisioning Checklist
The measure of IT onboarding is whether someone can do actual work on day one without filing a ticket. That requires starting before they arrive and provisioning from a role template rather than by copying the permissions of whoever sits nearest.
Identity & Access
Get templateUser Access Review Template
An access review where every manager clicks approve is worse than no review, because it manufactures evidence that access was checked. This template is built to produce the two things auditors actually test: a named reviewer who attested, and proof that the revocations they asked for happened.
Asset & Endpoint Management
Get templateIT Asset Inventory Template
Most asset registers die of one disease: nothing in the organisation forces them to be updated. This one is built around the three events that actually change an asset's state (assignment, repair, and disposal), so the register is maintained by the work rather than by an annual audit.
Frequently asked questions
What should an IT offboarding checklist include?
+
Identity provider disablement and session revocation, MFA device removal, VPN and remote access, privileged group membership, physical badge, mailbox and file transfer, API keys and tokens, non-federated system accounts, equipment recovery, licence reclamation, and a dated verification record.
How quickly should access be revoked when someone leaves?
+
For a resignation with notice, by the end of the last working day. For an involuntary termination, at the start of the meeting. For anyone holding privileged access, immediately, with every shared credential they knew rotated the same day.
Should you delete or disable a leaver's account?
+
Disable it. Deleting can orphan file ownership, break automations running under that identity, and destroy mailbox content you may need later. Disable immediately, unassign the paid licence immediately, and delete on a retention schedule of roughly 30 to 90 days.
What is usually missed during IT offboarding?
+
Anything outside the identity provider: SaaS bought on a card, local accounts on network appliances, direct database users, API keys embedded in scripts, and inbox forwarding rules. Keeping a standing list of non-federated systems is the only reliable fix.