A step-by-step IT checklist for onboarding new hires and offboarding departing employees: accounts, devices, MFA, licenses, and data retention for small teams.
Most small businesses handle onboarding and offboarding the same way: someone emails IT the day before a new hire starts, and someone remembers weeks later that a former employee still has access to email. Both are costly. A new hire who spends the first two days without a working laptop is an expensive first impression, and a former employee with live credentials is one of the most common sources of data leaks and account compromises. A written, repeatable checklist fixes both problems and takes about an hour to create.
Before Day One: Onboarding Preparation
Require a standard IT request at least five business days before a start date. It should include the employee's name, title, manager, department, start date, and which applications and shared folders they need. Building access by role rather than by copying another employee's permissions prevents the slow creep of excess access that makes breaches worse. Copying the account of someone who has been at the company for ten years gives the new hire ten years of accumulated permissions they do not need.
Prepare the device in advance. Assign a laptop from inventory or order one early, since business laptops can take a week or more to ship. Enroll it in device management such as Microsoft Intune before handoff so security policies, encryption, and required software install automatically. Confirm Windows and application updates are complete so the employee is not stuck waiting on restarts on day one. Our business laptop buying guide covers what specifications to order.
Create accounts with security on from the start. Create the Microsoft 365 or Google Workspace account, assign the correct license, add the user to the right security groups and shared mailboxes, and require MFA enrollment at first sign-in. Issue a temporary password through a secure channel, never in the same email as the username. Grant access to the company password manager and the shared vaults for their role, as described in our password manager guide.
Day One and the First Week
Walk the new employee through MFA setup in person or on a video call, ideally registering a passkey or the authenticator app on their phone. Show them where files live, how to reach IT support, how to report a suspicious email, and how to use the VPN or remote access tools if they work offsite. Enroll them in security awareness training within the first week, while habits are still forming; our security awareness training guide explains how to keep it short and effective.
Have the employee sign the acceptable use policy and confirm they received their equipment. Record the device serial number, asset tag, and any accessories in your asset inventory against their name. This record is what makes a clean offboarding possible later.
Offboarding: The Same Day, Every Time
Offboarding has to happen at a specific moment, ideally coordinated with HR so access is removed as the employee walks out of their final meeting, not the next morning. For involuntary terminations, disable access before or during the conversation. Start by blocking sign-in on the primary account, then revoke all active sessions and sign-in tokens. Simply resetting a password does not log out a phone that is already signed in to email, so session revocation is essential.
Work through every system the person could access: Microsoft 365 or Google Workspace, the password manager, VPN, line-of-business applications, accounting software, the payroll portal, social media accounts, vendor portals, building access cards and alarm codes, and any shared accounts. Rotate the passwords of any shared credentials they knew. A password manager with shared vaults makes this a list rather than a guessing game, because it shows exactly which shared credentials that person had access to.
Preserve data before deleting anything. Convert the departing user's mailbox to a shared mailbox or delegate access to their manager, set an automatic reply directing contacts to the right person, and transfer ownership of their OneDrive or Google Drive files. Check whether legal holds or retention requirements apply in your industry. Only after data has been preserved should you remove the license; Microsoft 365 and Google Workspace delete user data after a grace period once licenses are removed.
Recover and wipe devices. Collect the laptop, phone, security keys, and accessories against the asset inventory. For company devices, perform a full reset before reissuing. For personal phones enrolled in mobile device management, perform a selective wipe that removes only company data. Then reclaim the license so you are not paying for an empty seat, a common source of wasted spend highlighted in our IT budgeting guide.
Audit Quarterly
Once a quarter, compare the list of active accounts in Microsoft 365 or Google Workspace, your password manager, and key applications against current payroll. Any account without a matching employee should be investigated and disabled. Stale accounts are a favorite target for attackers because no one notices when they are used, and cyber insurers increasingly ask about this process, as covered in our cyber insurance requirements article.
Frequently Asked Questions
What should be on an IT offboarding checklist?
At minimum: block sign-in and revoke sessions on the primary account, remove access to every application and vendor portal, rotate shared passwords, preserve mailbox and file data, set an automatic reply, collect and wipe devices, remove building access, and reclaim licenses.
How quickly should a departing employee's access be removed?
Access should be removed at the moment employment ends, coordinated with HR. For involuntary terminations, disable accounts before or during the termination meeting. Waiting until the next day leaves a window for data theft or sabotage.
Is resetting a password enough to remove access?
No. Devices that are already signed in can keep accessing email and files after a password reset. Block sign-in and revoke all active sessions and tokens, then reset the password and remove MFA methods registered by the user.
If you want a documented onboarding and offboarding process, or want HelpTek to handle account setup and removal for you, HelpTek can handle account setup and removal for Albuquerque and Santa Fe businesses as part of our managed IT services. Contact us to get started.
