IT Offboarding Checklist: 14 Steps When Someone Leaves

Someone hands in their notice. HR sorts the paperwork, the team has leaving drinks, and everyone moves on.

But are their accounts still open three months later? For a lot of firms, the honest answer is “probably”.

Last week the ICO showed how badly that can go. It reprimanded a Welsh public body and its IT provider. Attackers got in through an account nobody needed. It had been left open for 12 years, with the password Password1.

This IT offboarding checklist gives you every step to close the door when someone leaves. It covers what to do before, on and after their last day. It also covers the Microsoft 365 traps that catch most firms out, and who should own each job.

Why does IT offboarding matter so much?

Every account that outlives its owner is a door nobody is watching. Nobody notices odd sign-ins, because nobody uses the account. Nobody resets the password, because nobody remembers it exists.

The ICO’s advice after the Password1 case was direct. Remove accounts you do not need, including test, dormant and former-user accounts, and audit the whole environment regularly.

Cyber Essentials says the same thing. Accounts must be removed or disabled when they are no longer needed, for example when someone leaves. If you hold the certificate, or plan to, a weak leaver process puts it at risk.

There is a cost angle too. Every forgotten account is often a licence you are still paying for.

What should an IT offboarding checklist include?

A good IT offboarding process runs in three stages. Use this table as your offboarding checklist template:

For a dismissal, or anyone leaving on bad terms, move the last-day tasks to the moment you tell them.

How do you offboard a leaver in Microsoft 365?

Most of the risk sits in Microsoft 365, because that is where the email, files and client data live. Microsoft publishes its own steps for removing a former employee. In short:

1. Block sign-in. This stops them getting into email, Teams and files.
2. Save what you need. Decide who needs the mailbox and OneDrive before you delete anything.
3. Wipe and block mobile devices. This removes company data from their phone or tablet.
4. Forward email or convert to a shared mailbox. Clients can still reach the role.
5. Give someone else access to OneDrive and Outlook data. Do this before you delete the account.
6. Remove the licence. Reassign it or stop paying for it.
7. Delete the account, unless a shared mailbox depends on it.

That sounds simple. Three details catch firms out.

The old password still works on a shared mailbox

Converting a mailbox to shared is a popular way to keep a leaver’s emails. But Microsoft’s own guidance warns that if you do not reset the password, the original username and password will keep working on the shared mailbox. Always reset the password and remove MFA methods, even after converting.

Blocking sign-in does not start the clock

A deleted user’s OneDrive is kept for 30 days by default. Their manager gets access, if a manager is set in the system. But that clean-up only starts when the account is deleted. Blocking sign-in or removing the licence does not trigger it. That is fine if it is a choice. It is a problem if nobody is tracking it.

Shared mailboxes have limits

A shared mailbox does not need a licence, but only up to 50GB. You also need a licence on the mailbox before you convert it, so convert first and remove the licence second. The account must stay in place, because the shared mailbox depends on it.

Running mostly on Microsoft 365? Our guide to Microsoft 365 for professional services firms covers the settings that make leavers easier to handle.

What do most offboarding processes miss?

Microsoft 365 is only half the job. These are the gaps that come up again and again:

• Systems outside Microsoft 365. Xero, Sage, practice management, CRM, EPOS back office, booking platforms, production software. Each has its own login.
• Supplier and portal accounts. HMRC agent services, bank portals, supplier ordering sites, the domain registrar. Often registered to one person’s email.
• Shared logins. The Wi-Fi password, the alarm code, the shop floor PC, the manager PIN on the till.
• Admin rights. If the leaver was the person who “did the IT”, they may hold global admin rights.
• MFA on a personal phone. Their authenticator app may still be the second factor for a shared account.
• Remote access. VPNs, remote desktop tools and any supplier access they set up.

Picture a 30-person law firm in Chester. A partner retires. Her account is blocked on day one, so the job looks done. Six months later the firm discovers she was the only registered user on the bank portal and the domain registrar. (This is an illustrative example, not a real client.)

Or picture a manufacturer in Ellesmere Port. A maintenance engineer leaves. He had remote access to the production line software from home, set up by the machine supplier. Nobody on the office side knew it existed.

In hospitality, staff turnover makes this a weekly job. Picture a general manager leaving a Liverpool restaurant group. They may still hold logins for the EPOS back office, the booking platform and the rota app at every site.

What is a joiner mover leaver process?

Offboarding is the last stage of a bigger cycle, often called the joiner mover leaver process. Joiners get only the access they need. Movers lose access from their old role when they change jobs. Leavers lose everything.

Movers are the forgotten middle. Someone moves from accounts to operations and keeps both sets of access. Repeat that a few times and one person can see everything.

If you only fix one thing, make the joiner checklist and leaver checklist mirror each other. Anything you give on day one goes on the list to take back on the last day.

Who should own the IT offboarding process?

The Password1 case is a warning here. The ICO reprimanded both the client and its IT provider, and said the responsibility did not sit with one organisation alone.

In most firms, the split works like this:

• HR or the practice manager triggers the process the day notice is given.
• The line manager lists the systems, collects kit and confirms handover.
• IT, in-house or outsourced, does the technical steps and keeps a record.
• A named owner, usually the MD or ops director, signs off that it is complete.

If you use an outside IT provider, check your contract says who removes accounts and how fast. If you have an in-house IT person too, our guide to co-managed IT support explains how to split the work without gaps.

Frequently asked questions

How quickly should you remove access when an employee leaves?

Block sign-in on their last working day, at the end of the day. For a dismissal, do it at the moment you tell them. Leave the clean-up of mailboxes and licences for the following days.

Should I delete a leaver’s Microsoft 365 account straight away?

Not always. Save the mailbox and OneDrive data you need first. Once you delete the account, Microsoft keeps that content for 30 days by default. If you convert the mailbox to shared, keep the account, because the shared mailbox depends on it.

Can a leaver still get into a shared mailbox?

Yes, if you do not reset the password. Microsoft says the original username and password keep working on the shared mailbox after conversion. Reset it every time.

Do I need an IT offboarding checklist for Cyber Essentials?

Cyber Essentials does not demand a specific document. It does require you to remove or disable accounts when they are no longer needed. A written checklist is the easiest way to prove you do.

Want to know what is still open?

Most firms find at least one leaver account they forgot about. Want a free, no-obligation IT review call? We will help you spot old accounts, unused licences and other quick wins. Just get in touch or call 0330 313 0966. Cirrus is Cyber Essentials certified, and you can read more about our managed IT support in Cheshire.

Related reading

• Microsoft 365 for professional services firms: are you actually using it?
• Co-managed IT support: how it works, costs and what to expect