IT Offboarding Procedure: Revoking Access for Departing Employees

Short answer: thorough IT offboarding covers five things: disabling all accounts (email, applications, VPN, admin accounts), recovering devices, transferring data and file ownership, ending licenses that are no longer used, and changing shared credentials the employee knew. Everything is recorded, and it starts with HR notifying the IT team before the last day.

When an employee leaves, a company’s attention usually goes to the handover of work and personnel administration. IT matters are often left behind: email accounts are left active “just in case”, laptops are returned without being checked, and shared account passwords are never changed. Forgotten old accounts pile up, and each one is a door that is still open.

Why IT offboarding often leaks

Three causes recur in many companies:

1. There is no access list. The IT team does not know exactly which applications an employee uses, especially subscription-based applications registered by divisions on their own.
2. Notification comes late. HR handles the resignation, but the IT team only finds out after the employee has left, or is not told at all.
3. Shared accounts. Passwords for social media accounts, service provider accounts, or network devices are used by several people, and no one remembers to change them.

IT offboarding checklist

Area	What to do
Main accounts	Disable email and directory accounts, set up email forwarding or an auto-reply if needed
Applications	Revoke access to internal applications, subscription applications, and systems with separate logins
Remote access	Revoke VPN accounts, active sessions, and devices registered for two-step authentication
Privileged accounts	Revoke admin rights on servers, cloud panels, network devices, and code repositories
Shared credentials	Change passwords of accounts used in common that the employee knew
Devices	Recover laptops, company phones, access cards, and tokens; check their condition
Data	Transfer ownership of shared files and folders, back up the mailbox if policy requires it
Licenses	End or reassign licenses that are no longer used
Records	Record every step, the date, and who carried it out

A clear division of duties

Tidy offboarding depends on sequence and division of duties, not on one person’s hard work:

• HR tells the IT team as soon as the last date is known, including when an employee leaves suddenly.
• The direct manager ensures the handover of work and names the applications or accounts the employee used outside the main systems.
• The IT team runs the checklist, revokes access at the agreed time, and records the results.

For employees with privileged access, such as system or finance admins, revocation should happen at the exact moment the employment ends, not the next day.

Sequence on the last day

The checklist above is most effective when done in a fixed order:

1. In the morning: confirm the handover of work is complete and important files have been moved to a shared folder or to the colleague taking over.
2. Before working hours end: recover devices and access cards, then check their condition together with the employee.
3. When working hours end: disable the main account, remote access, and privileged accounts. End sessions that are still active on all devices.
4. On the same day: change the passwords of shared accounts the employee knew, and set up email forwarding if needed.
5. Within the same week: end or reassign licenses, wipe company data from returned devices before anyone else uses them, and archive the offboarding records.

Common mistakes

• Disabling only email. Applications with separate logins, such as service provider panels or divisional subscription applications, remain open.
• Leaving the account active for handover. If a colleague needs access to files, transfer the file ownership, do not lend out the account.
• Forgetting two-step authentication devices. A personal phone registered as a verification device can still be used if the account is reactivated.
• No records. Without records, no one can confirm which access has been revoked.

Preventing it from day one

Offboarding becomes easy when onboarding is recorded. Every access granted when an employee joins is noted in a single list, so when they leave, that list simply gets reversed. An up-to-date asset list also helps: which device is held by whom, and which license is used by whom.

Two other habits reduce risk: reduce shared accounts by giving each person their own, and review the access list periodically, for example every quarter, to find accounts that slipped past earlier offboarding.

How Legia does it

In the IT Support & Infrastructure Management service, all access of a departing employee is revoked as soon as Legia receives the notification, and then documented. Legia also maintains a continuously updated list of devices, accounts, and licenses, so you know who uses what. A comparison of ways to handle office IT, from in-house staff to a subscription, is in the article IT Support Subscription, In-House IT Staff, or Call When Something Breaks?

Frequently asked questions

Sources

• NIST SP 800-53 Rev. 5, control PS-4 Personnel Terminationcsrc.nist.gov

Who is responsible if old access is abused?

In practice, the company bears the impact. That is why recording every offboarding step matters: it shows that access has been revoked and when.

Need a team that looks after devices, accounts, and the office network without hiring your own IT staff? See Legia IT support and consulting services, or schedule a consultation through the contact page.