Employee offboarding (IT)
Also known as: IT offboarding, user deprovisioning
IT offboarding is the process of securely ending a departing employee's access to company systems and recovering company devices and data.
It includes disabling accounts, revoking sessions and MFA, transferring email and files, removing access to shared passwords and third-party apps, and collecting laptops and phones. While offboarding sounds simple, forgotten accounts are a common cause of breaches and data leaks, especially for cloud apps signed up for outside IT's view.
Employee offboarding (IT), explained at three levels
At home
Offboarding is like a roommate moving out. You collect their keys, change the locks if they had copies made, cancel shared subscriptions and take their name off the mailbox. At work, IT does the same thing digitally: it disables accounts, signs the person out everywhere, collects devices and hands their files to someone else, so they can no longer get back in.
At work
IT offboarding ends a departing employee's access to company systems. It includes disabling their account, signing them out of every app, removing MFA, transferring email and files to a manager, changing shared passwords they knew and collecting company devices. Businesses care because accounts left open after someone leaves can be misused by that person or by an attacker who steals the forgotten password.
At home
Offboarding removes a departing employee's access in the right order. Disabling their account stops new sign-ins, but apps they are already signed in to keep working until their session tokens expire, which can be hours or days. So IT also revokes sessions, removes MFA methods and resets passwords. Their mailbox and files are handed to a manager, and company devices are collected or remotely wiped, so nothing belonging to the company stays with them.
At work
A standard checklist covers disabling the account, revoking sessions, removing MFA methods and app passwords, converting the mailbox to a shared mailbox or setting forwarding, transferring OneDrive files, removing group memberships and licences, and wiping or retrieving devices. Accounts in apps outside single sign-on, such as social media or vendor portals, need separate removal. Holding the account disabled for a retention period before deletion preserves data for legal or business needs.
At home
When you leave a job, your access may outlive your employment in small ways: shared documents still list you, group chats keep sending messages, and personal devices may still hold work email. You might also have work data in personal cloud storage. Cleaning these up protects you as well as the employer. In my view, it is courteous to remove yourself from work groups and delete work files from personal devices when you leave.
At work
Use single sign-on and automated deprovisioning through SCIM so disabling one account removes access everywhere connected. Maintain a SaaS inventory to catch apps outside SSO, rotate shared passwords and API keys the person knew, and check mailbox forwarding and inbox rules they created. For sensitive departures, coordinate timing with HR so access ends as the conversation happens, review recent data downloads, and retain logs for possible disputes.
Real-world examples
At home
Lena left her job and returned her laptop. A week later, she noticed she could still open a shared file and let her former manager know.
At work
Jerome's Saskatoon MSP found that a client's departed sales manager still had access to their CRM and social media accounts. They built a full offboarding checklist covering every app.
How it compares
| feature | Good offboarding | Poor offboarding |
|---|---|---|
| Timing | Same day as departure | Days, weeks, or never |
| Scope | All systems, including SaaS | Email only |
| Shared passwords | Rotated | Unchanged |
| Devices | Collected and wiped | Untracked |
Good offboarding closes every door. Poor offboarding leaves some open.
For analysts
I'd make offboarding an HR-triggered workflow with IT tasks and sign-off. A checklist that depends on someone remembering will eventually miss something.
History & origin
Offboarding was once mainly about collecting keys and badges and disabling a network account. As businesses adopted dozens of cloud apps in the 2010s, departing employees often kept access to tools such as file-sharing, social media, and SaaS accounts that IT didn't know about. High-profile cases of former employees deleting data or taking customer lists highlighted the risk. Identity providers with single sign-on and automated deprovisioning, such as through the SCIM standard published in 2015, made offboarding faster and more complete. In my view, offboarding is where small businesses discover how much IT they didn't know they had.