Employee offboarding checklist (20 items)
Free sample from Runbook Foundry · CC BY 4.0 · Works for Microsoft 365, Google Workspace and most SaaS
Leaver: __________ Manager: __________ Last day: __________ Exit type: ☐ Standard ☐ Urgent (involuntary)
For an urgent exit, do items 1 to 6 before or during the conversation with the employee, not after it.
Identity and access (same day)
| # | Step | Done | By / date |
|---|---|---|---|
| 1 | Block sign-in or suspend the main account (directory or identity provider) | ☐ | |
| 2 | Reset the password and revoke all active sessions and refresh tokens | ☐ | |
| 3 | Remove MFA methods, app passwords and backup codes registered by the user | ☐ | |
| 4 | Remove all admin roles and privileged group memberships | ☐ | |
| 5 | Disable or remove accounts in SaaS apps that don't use single sign-on | ☐ | |
| 6 | Revoke VPN, remote access and any shared or "break-glass" credentials they knew, and rotate those secrets | ☐ |
Email and files (within 24 hours)
| # | Step | Done | By / date |
|---|---|---|---|
| 7 | Remove mail forwarding rules and delegates the user set up | ☐ | |
| 8 | Set an auto-reply or route mail to the manager, as agreed with HR | ☐ | |
| 9 | Transfer ownership of files, shared drives and documents the business needs | ☐ | |
| 10 | Review files the user shared externally or publicly, and remove those links | ☐ | |
| 11 | Remove the user from distribution lists, groups and team channels | ☐ | |
| 12 | Revoke third-party (OAuth) app access granted by the user | ☐ |
Devices and physical access (by the last day)
| # | Step | Done | By / date |
|---|---|---|---|
| 13 | Collect laptop, phone, security keys, badges and keys (record serial numbers) | ☐ | |
| 14 | Remove company data from personal devices (selective wipe) or wipe company devices | ☐ | |
| 15 | Deactivate building access cards and alarm codes | ☐ | |
| 16 | Remove the user from shared password vault collections | ☐ |
Records and cleanup (within 30 days)
| # | Step | Done | By / date |
|---|---|---|---|
| 17 | Apply your retention or legal hold decision to the mailbox and files before deleting anything | ☐ | |
| 18 | Reassign or cancel licenses and subscriptions in the user's name | ☐ | |
| 19 | Update emergency contact lists, on-call rotas and supplier contacts that named the user | ☐ | |
| 20 | Have the manager confirm in writing that access is removed, and file this checklist | ☐ |
Sign-off: IT __________ Date ______ · Manager __________ Date ______
Templates and guidance only, not legal or HR advice. Drafted with AI assistance and reviewed for accuracy. Not affiliated with Microsoft or Google.