Offboarding Employees Securely: A Checklist and What to Automate

Offboarding is where security policies meet reality. The new-hire process has a form and a manager who wants their person working. The leaver process has a rushed email at 4pm on a Friday, and the account stays active for a month because nobody was sure whether HR had told IT.

The fix is a checklist that is ordered by risk, triggered by a single event, and automated wherever a script can do it better than a memory. Here is the checklist we use and the parts that should never be manual.

The trigger and the first hour

Everything starts from one signal: HR or the owner opens an offboarding ticket with the person's name, last working day, and whether it is planned or immediate. Without a single trigger, IT hears about departures from the grapevine. Make the ticket the only way it happens and make it easy to submit.

For an immediate departure, the first hour is about revoking access before the person walks out. For a planned departure, the same steps run at the end of the last day. The order matters: identity first, because most other systems trust it.

1. Disable the identity account (Entra ID, Google Workspace, or Active Directory) and revoke all active sessions
2. Reset the password so cached credentials on personal devices stop working
3. Remove MFA methods and registered devices from the account
4. Disable VPN and remote access, and revoke any certificates issued to the user
5. Disable accounts on systems that do not use single sign-on: the ERP, the phone system, cloud tools with their own logins
6. Wipe or lock company devices remotely through the MDM if they are not in hand

Update-MgUser -UserId $upn -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $upn

The first day: data, mail and devices

Once access is cut, preserve what the business needs. Convert the mailbox to a shared mailbox or set a litigation hold if the role or the circumstances warrant it, and give the manager access. Set an auto-reply that names who to contact. Forward the phone extension.

Transfer ownership of files in the user's cloud drive to their manager and record what was transferred. Collect the laptop, phone, badge, keys and any tokens, and update the inventory with their status. Check the vault for shared credentials the person knew and rotate them, starting with anything that reaches production or money.

• Mailbox converted to shared or held, manager granted access, auto-reply set
• Cloud drive ownership transferred, with a record of what moved where
• Devices collected, wiped, and re-inventoried as Spare or Reassigned
• Shared credentials the person had access to rotated, from the vault's access log
• Distribution lists, Teams or Slack channels, and calendar delegations cleaned up
• Licences reclaimed after the retention period so the seat is not billed forever

What to automate

The first-hour steps are the ones to script, because they are the same every time and they are the ones that get missed under pressure. A PowerShell script or an automation flow that takes a user principal name and performs the disable, session revoke, MFA removal, group removal and mailbox conversion in one run turns a twenty-minute checklist into a thirty-second action with a log.

Tie the script to the ticket. When the offboarding ticket is created with a last day, the automation runs at the end of that day and posts the log back to the ticket. The remaining manual steps, device collection and credential rotation, become the checklist the technician confirms. Test the script on a dummy account every quarter, because tenants change and cmdlets get deprecated.

1. Write a single script that takes a UPN and runs the identity steps in order
2. Have it log every action and post the log to the offboarding ticket
3. Schedule it from the ticket's last-day field, with a manual run option for immediate cases
4. Keep the physical and rotation steps as a checklist on the same ticket
5. Test against a test account quarterly and after any tenant change

Get-MgUserMemberOf -UserId $upn | ForEach-Object { Remove-MgGroupMemberByRef -GroupId $_.Id -DirectoryObjectId $userId }

The audit and the edge cases

Once a quarter, list every enabled account in the identity tenant and every account in the systems that do not use single sign-on, and compare against the HR roster. Any account without a current employee behind it is either a service account that should be documented or a leaver who was missed. Do the same for VPN users and for admins on the firewall and the RMM.

Edge cases need their own lines on the checklist: contractors whose access ends with the contract, the owner's family member who has a login, the former employee who is now a vendor and needs a different kind of access, and departing IT staff, whose offboarding includes rotating every administrative credential they ever touched.

Frequently asked questions

Takeaway

One trigger, an ordered checklist, and a script for the identity steps. Cut access first, preserve data second, collect and rotate third, and audit the accounts every quarter against the roster. The departure that happens at 4pm on a Friday is exactly the one the automation is for.