How to Offboard an Employee Without a Security Gap

TL;DR: Offboarding is a checklist problem, not a memory problem. If you rely on someone remembering to disable an account a week after the exit interview, you already have a gap. Build the list once, run it every time, and treat the last hour of employment like the security event it actually is.

What You Need

Before the employee's last day, you need these things ready. Not gathered after they walk out. Ready.

1. A current inventory of every system the employee had access to (email, file shares, VPN, SaaS apps, financial software, building access, shared passwords)
2. Admin credentials for your identity provider (Microsoft 365, Google Workspace, or whatever you run)
3. A designated person who owns the offboarding checklist from start to finish
4. A way to preserve the employee's data before wiping anything (email archive, file transfer, OneDrive/SharePoint content)
5. Physical assets list: laptop, phone, badge, keys, any hardware tokens
6. A copy of any shared or generic passwords the employee knew (these all need rotating)

If you don't have an access inventory, that's the real problem, and it's worth fixing before your next hire or termination, not during one. A managed IT provider can build and maintain this list so it's never a scramble.

Step 1: Time It Correctly

The biggest mistake in offboarding is timing. Access should be cut at the moment of termination, not sometime that afternoon, not "when IT gets to it."

1. For involuntary terminations, access should be disabled at the exact time of the meeting, not before (which tips them off) and not after (which leaves a window)
2. For voluntary resignations with notice, decide case by case whether the employee keeps full access during the notice period or gets moved to restricted access immediately
3. If there's any risk the departure is contentious, cut access first and explain second. Reputational risk from being fast is nothing compared to the risk of a bad actor with 15 unsupervised minutes
4. Coordinate HR, management, and IT so all three act within the same narrow window. A gap between the HR conversation and the IT action is exactly when data walks out the door

Step 2: Disable, Don't Delete, Accounts Immediately

Disabling and deleting are not the same action, and mixing them up causes problems later.

1. Disable the account in your identity provider first. This kills login access instantly without destroying the mailbox or files
2. Force sign-out of all active sessions on every device and browser. A disabled account with an already-open session can still be usable until the token expires
3. Revoke all app passwords, API keys, and OAuth tokens tied to that account
4. Reset or remove multi-factor authentication methods registered to that employee, especially if they used a personal phone for MFA codes
5. Hold off on permanent deletion for a set retention period (30 to 90 days is common) in case you need to recover files or investigate something later
6. Convert the mailbox to a shared or archived mailbox if someone else needs to review incoming email during the transition

If you're running Microsoft 365, this whole sequence can be scripted so it happens in minutes instead of being handled one click at a time under stress. Worth setting up once through your Microsoft 365 admin console or with help from your IT provider.

Step 3: Chase Down Every Third-Party App

This is where most gaps actually live. Nobody forgets to disable the main email account. People forget the twelve SaaS tools connected to it.

1. Pull a list of every app the employee had a login for: CRM, accounting software, project management, cloud storage, marketing platforms, industry-specific software
2. Check for apps where the employee signed in using "Sign in with Google" or "Sign in with Microsoft." These are often invisible until you audit your identity provider's connected apps list
3. Remove the employee from any shared logins (this is also why shared logins are a bad idea long term, but that's a separate conversation)
4. Cancel or reassign any software licenses tied to their name so you're not paying for a seat nobody uses
5. Check for any automation or integrations the employee set up personally (email forwarding rules, Zapier connections, scheduled reports) that might still be running under their credentials

An hour spent building this app inventory before you need it saves you a scramble every single time someone leaves. This is a standard part of a real business cybersecurity program, not an extra.

Step 4: Handle Passwords and Shared Credentials

If the employee ever knew a password that other people still use, that password is now compromised. Full stop.

1. Rotate any shared account passwords: shared email inboxes, social media accounts, vendor portals, Wi-Fi passwords if they're not tied to individual logins
2. Change passwords on any admin-level accounts the employee had access to, even if they didn't use them often
3. Update your password manager to remove their access and rotate anything they could see
4. If the employee had physical or remote access to a server, firewall, or network device, change those credentials too
5. Document which passwords were rotated and when, so you're not guessing six months later whether something got missed

Worried your business is one click from a breach? Get a security review

Step 5: Recover Physical and Digital Assets

Hardware is easy to track. Data on that hardware is not, so treat this as two separate jobs.

1. Collect all company hardware: laptop, monitor, phone, tablet, security keys, badges, keys
2. Before wiping any device, confirm whether there's business data on it that needs to be preserved or migrated (local files, saved passwords in browsers, downloaded email)
3. Check for personal cloud accounts synced to the device (personal Dropbox, personal Gmail) and make sure company files weren't backed up somewhere you don't control
4. Wipe and reimage the device before it's reassigned. Don't just delete the user profile and hand it to the next hire
5. If the employee used a personal device for work (email on their phone, VPN on their laptop), remove company data and access through mobile device management or manual removal, and confirm it's done
6. For departing IT staff or anyone with elevated access, this step matters even more. A quick computer repair shop visit to properly wipe and verify a returned machine is cheap insurance compared to a device leaving the building with company data still on it

Step 6: Review Network and Remote Access

Accounts aren't the only door. Networks have their own.

1. Remove the employee's VPN credentials and any remote desktop access
2. Check firewall rules and remote access software for anything configured specifically for that person
3. If the employee had a static IP allowance or a whitelisted device, remove it
4. Review your business networking setup for any guest or personal devices they connected that are still sitting on your network
5. If they had physical access to network closets, server rooms, or on-prem equipment, change any physical locks or access codes tied to that access

Step 7: Confirm Backups Aren't Affected

Offboarding sometimes intersects badly with backup and recovery systems, especially if the employee managed backups or had files that only existed on their machine.

1. Confirm the employee's OneDrive, SharePoint, or local files are backed up or transferred before their account is deactivated
2. If the employee administered your backups and disaster recovery system, transfer that responsibility and change any credentials tied to it
3. Test that backup jobs still run correctly after their account changes, since removing a user account can sometimes break a scheduled backup that was tied to that login

Step 8: Document and Debrief

The checklist isn't done until it's written down.

1. Record every account disabled, every password rotated, every asset returned, with dates and who did it
2. Note anything unusual: access you found that shouldn't have existed, apps nobody knew about, permissions that were broader than they should have been
3. Use that debrief to tighten your access policy so the next offboarding is faster and cleaner
4. If anything felt uncertain during the process, that's a sign your access inventory or offboarding checklist needs updating before the next departure

Common Mistakes

1. Waiting until the exit interview is over to start disabling access. Every extra minute is a window.
2. Forgetting shared or generic accounts because they're not tied to one obvious identity.
3. Deleting the account outright instead of disabling it first, which can destroy data you need for legal, financial, or investigative reasons.
4. Not checking for personal devices that still have company email, VPN access, or synced files.
5. Skipping the SaaS audit because it's tedious. This is exactly where old logins linger for months or years.
6. Treating IT and HR as separate timelines instead of coordinating the exact moment access gets cut.
7. Assuming a friendly departure means low risk. Most gaps aren't caused by malice. They're caused by an account nobody remembered to close.

Bottom Line

Offboarding isn't a courtesy step at the end of employment, it's a security control, and it needs to be treated with the same seriousness as onboarding. The businesses that get burned aren't usually the ones who fired someone angry. They're the ones who let a checklist slide because things felt calm. Build the list once, assign clear ownership, and run it the same way every time, whether it's a friendly retirement or a difficult termination. If you don't currently have a documented offboarding process, or you're not confident every account and app is accounted for, that's worth fixing this week through a business IT review, not after the next departure happens. If you want a second set of eyes on your current process, contact us and we'll walk through it with you.

Worried your business is one click from a breach?

Get a straight-talk security review from a local team that has cleaned up the aftermath more times than we'd like.

Get a security review

Frequently asked questions

How quickly should employee access be disabled after termination?

Immediately, ideally within the same window as the termination conversation itself. For involuntary terminations, access should be cut at the moment the meeting starts, coordinated between HR and IT so there's no gap between the conversation and the action.

Should we delete an employee's account or just disable it?

Disable it first. Deleting immediately can destroy mailbox content and files you may need later for legal, financial, or investigative reasons. Most businesses keep disabled accounts for 30 to 90 days before permanent deletion.

What's the most commonly missed step in offboarding?

Third-party SaaS apps and services connected through single sign-on. Email and file access usually get handled, but individual logins to CRM tools, marketing platforms, or apps signed in with a company Google or Microsoft account often get forgotten.

Do we need to change shared passwords when someone leaves?

Yes. Any password the departing employee knew, whether it's a shared inbox, social media account, Wi-Fi password, or vendor portal, should be considered compromised and rotated as part of the offboarding process.

What about employees who used personal devices for work?

Company email, VPN access, and synced files need to be removed from personal phones and laptops as part of offboarding. This usually requires mobile device management tools or manual removal, and it should be verified, not just requested.

Can a managed IT provider handle offboarding for us?

Yes, and it's a common part of managed IT service. A provider can maintain the access inventory, script the disable process for consistency, and make sure nothing gets missed even when a departure happens on short notice.