The Essential IT Checklist for Offboarding Employees: 15 Steps to Protect Your Company

This document aims to provide you with real-world steps to protect your company’s IT infrastructure.

When an employee leaves your company, whether voluntarily or not, it’s crucial to ensure their departure is handled properly from an IT standpoint. Failure to follow through on key offboarding tasks can lead to costly cybersecurity risks, forgotten SaaS subscriptions, and compliance issues. By thoroughly addressing all aspects of IT during the offboarding process, you can safeguard your company’s data, streamline operations, and avoid unnecessary expenses.

This document focuses on organizations using Microsoft 365. While Google Workspace accounts also require the same level of diligence, there are fewer options for easily managing the departing user’s account.

The steps below include specific steps to properly manage the departing employee’s account while ensuring their absence doesn’t disrupt daily operations.

This checklist will walk you through 15 must-do tasks, helping you handle the process smoothly and securely. From managing their email and OneDrive accounts to closing other SaaS subscriptions, it covers what you need to know to keep your company secure and efficient. At the end, you will find a link to a downloadable checklist so you can add these to your current HR department’s offboarding checklist.

15-Point IT Offboarding Checklist

1. Disable Microsoft 365 Login Access Immediately

The first step is to disable the departing employee’s access to Microsoft 365. This ensures they can no longer log into the system, preventing unauthorized access to emails and company files.

If your company leverages Microsoft Intune, you can use Selective Wipe to remove company data (such as emails, files, and other organizational content) from an employee’s mobile device while leaving personal data intact.

2. Disable Network or Active Directory Account

Immediately disable the departing employee’s network or Active Directory account to prevent unauthorized access to the company’s internal resources. This step is crucial in maintaining the security of your organization’s network and data.

3. Convert the Employee’s Mailbox to a Shared Mailbox

Converting their mailbox to a shared one allows the company to retain access to important emails without using a paid license. This is especially useful for maintaining historical communication records.

4. Set Up Email Forwarding and/or an Autoresponder

Forward any emails sent to the departing employee’s address to a designated team member to ensure critical messages aren’t missed. This step helps keep business running smoothly after their departure.

You can also set up an automatic reply that informs senders of the employee’s departure and provides alternate contact information. This prevents miscommunication and helps external partners or clients stay connected with the right people.

5. Delegate Access to the Mailbox and OneDrive

Assign delegate access to the former employee’s email and OneDrive accounts to a trusted colleague. This allows the team to retrieve any necessary documents or communications, avoiding workflow disruptions.

6. Remove or Transfer Microsoft 365 Licenses

Ensure that the Microsoft 365 license tied to the employee is either deactivated or transferred. This prevents your company from paying for unused subscriptions and ensures compliance with licensing agreements.

7. Audit and Deactivate SaaS Accounts

Review all SaaS applications the employee had access to and deactivate their accounts. Unused or “zombie” SaaS accounts can lead to unnecessary costs and pose serious security risks, as they are often overlooked in routine audits.

Dive deeper into this here <link to short blog post>.

8. Revoke Access to Company Cloud Services

Ensure the employee’s access to cloud services such as OneDrive, SharePoint, and Teams is revoked. This step protects sensitive company data from potential breaches or accidental sharing.

9. Reclaim Company-Owned Devices

Retrieve all company-issued devices, including laptops, phones, and tablets. Make sure these devices are wiped of any sensitive data before they are reassigned or stored.

10. Reset Passwords for Shared Accounts

If the employee had access to any shared accounts, reset all passwords. This prevents unauthorized access and helps maintain the security of sensitive information.

A tool like Keeper for Enterprise can greatly simplify and enhance the process of resetting passwords for shared accounts during the offboarding process. Keeper for Enterprise provides a centralized vault where all shared account credentials are stored securely. Look for an upcoming article that discusses how your company can leverage a tool like Keeper to manage credentials better, especially shared account credentials.

11. Disable Access to Company VPNs

Disconnect the employee from Virtual Private Network (VPN) services to avoid unauthorized remote access to the company’s internal network.

12. Terminate Access to Communication Tools

Remove the employee from team communication platforms like Microsoft Teams, Slack, and Zoom to ensure they no longer have access to company discussions and meetings.

13. Archive Chat and Communication Histories

Back up or archive any relevant chat histories or communications before disabling the employee’s accounts. This can be important for compliance or future reference.

14. Monitor Account Activity After Termination

For additional security, monitor the former employee’s accounts for suspicious activity after offboarding. This helps ensure no unexpected access occurs post-departure.

15. Conduct a Final Security Audit

Finally, a full security audit should be performed to confirm that all accounts, devices, and data access have been properly managed. This is essential to closing any potential loopholes or risks left behind.

Conclusion

Proper IT offboarding is critical in protecting your company from potential cybersecurity threats, financial losses, and operational inefficiencies. By following this checklist, especially in environments like Microsoft 365, you can ensure that your offboarding process is smooth, secure, and cost-effective. Staying on top of these steps protects your business and keeps your IT infrastructure clean, organized, and secure.

The Role of a Managed Service Provider (MSP)

Partnering with a Managed Service Provider (MSP) that utilizes a thorough offboarding checklist can provide an additional layer of protection. An experienced MSP ensures that all steps, from disabling accounts to resetting passwords, are handled in a timely and comprehensive manner. They can manage the entire offboarding process, so nothing is overlooked, including tracking SaaS subscriptions and closing any ‘zombie accounts.’

With an MSP managing the offboarding, you can rest assured that your company’s data and systems are fully protected. Their expertise reduces the risk of internal oversights and minimizes the chances of cybersecurity breaches. Ultimately, having an MSP with a robust offboarding checklist ensures a seamless transition, securing your business against potential threats and unnecessary costs.

If you are looking for an IT provider who can help with all of this and much more, please contact Sid Payne at sales@viatek.net.

A little more about ViaTek

Link to downloadable checklist.