Employee offboarding checklist (2026): IT, HR and security steps

An employee offboarding checklist covers five owners and four moments. When notice is given, HR records the end date in the HRIS and IT, finance and the manager are told the same day. In the last week, the manager runs knowledge transfer, IT lists every account and device, and file and app ownership is reassigned. On the last day, IT disables the identity account and revokes sessions within the hour of departure, devices are collected or locked, and HR handles final pay and benefits notices. After departure, IT reclaims licenses, closes leftover access and checks sign-in logs at 30, 60 and 90 days, and HR retains records under policy.

At a glance

Most published checklists cover one team: HR exit forms skip access removal, IT checklists skip final pay. This one puts every owner on one timeline.

Phase 1: When notice is given

1. HR: Record the termination date, type (voluntary or involuntary) and last working day in the HRIS. This record triggers everything else.
2. HR: Notify IT, security, finance and the manager the same day, through the HRIS or a ticket.
3. HR: Check the contract for notice period, confidentiality and non-solicit clauses, and equity or bonus terms.
4. Manager: Agree a handover plan: open projects, recurring meetings, customer and vendor contacts, and who takes each.
5. Manager: Decide how and when the team, customers and partners are told.
6. IT: Pull the access inventory: identity provider groups, SSO apps, apps outside SSO, admin roles, code repositories, cloud consoles, shared vaults, VPN, badges and assigned devices.
7. IT: Check the device record and start the return. For remote staff, ship the box now (see how to get laptops back from departing employees).
8. Security: Flag high-risk departures (admins, engineers with production access, people leaving for a competitor) for closer timing and monitoring.
9. Finance: Note outstanding expenses, corporate cards, loans or advances, and any equipment buyout.

Phase 2: The last week

1. Manager: Run knowledge transfer sessions and get written handover notes into a shared location the team owns.
2. IT: Produce an ownership report: files and shared drives, apps the person administers, open tickets, pending approvals, calendars and on-call rotations.
3. Manager and IT: Reassign each item before the last day.
4. IT: Move service accounts, API keys and integrations created under the employee's name to a service owner.
5. IT: Confirm the email plan: forwarding, auto-reply, delegate access for the manager, or conversion to a shared mailbox.
6. HR: Schedule the exit interview and prepare exit documents: final pay statement, benefits information, property acknowledgment and confidentiality reminder.
7. Employee: Prepare devices, badges, keys and cards for return, and remove personal files.
8. Finance: Request final expense reports and cancel or set a closing date for corporate cards.

Phase 3: Last day, within the hour of departure

1. IT: Disable the account in the identity provider at the agreed time. Disable, do not delete.
2. IT: Revoke active sessions and refresh tokens in the same step; disabling alone does not end open sessions.
3. IT: Remove access that does not run through SSO: local app accounts, VPN, cloud console users, repository membership.
4. IT or security: Remove admin and privileged roles, and revoke personal access tokens, SSH keys and API keys.
5. IT: Rotate passwords for shared accounts the person knew and remove them from shared vaults.
6. IT: Collect the device in person, or lock it through MDM if it is not back yet.
7. Facilities: Deactivate badges and collect keys.
8. HR: Hold the exit conversation, collect signed acknowledgments, and provide final pay according to the applicable state law.
9. Manager: Confirm handover is complete and announce the departure.

For the step-by-step commands in Microsoft Entra ID, Okta, Google Workspace and GitHub, see how to revoke access when an employee leaves.

Phase 4: After departure (30, 60 and 90 days)

1. IT, day 1: Check sign-in logs for any successful sign-in by the disabled account.
2. IT, day 1 to 7: Confirm application owners removed local accounts and that devices are received, wiped and logged in the asset record.
3. HR, within 30 days: If you have a group health plan covered by COBRA, notify the plan of the qualifying event.
4. Finance, first payroll cycle: Close final payroll, reconcile expenses and cancel cards and subscriptions billed to the person.
5. IT, day 30: Reclaim licenses, convert or archive the mailbox, transfer remaining files, then delete what your retention policy allows.
6. IT and security, day 60: Include the leaver in the next user access review, including apps IT does not manage.
7. HR, day 90: Review exit interview themes and add anything that was missed to the checklist.

IT and security offboarding checklist

This is where a slip creates risk. Each item needs an owner and a completion record.

A Microsoft 365 shared mailbox needs no license while it is under 50 GB, so conversion is a cheap way to keep a leaver's mail available. To catch apps that never went through SSO, see how to find shadow IT apps.

Voluntary vs involuntary terminations

Voluntary departures give you a notice period. Use it for knowledge and ownership transfer while the person can still answer questions, and end access at a set time on the last day.

Involuntary departures compress the timeline. Access should end at or before the conversation, so IT needs a confidential heads-up and a person ready to act at a scheduled time. Run Phase 3 first, then rebuild knowledge transfer from documents and the team. Collect devices at the meeting, or lock them through MDM for remote staff. Final pay rules can differ for a discharge, as the California example below shows.

Layoffs add volume. Prepare the list in advance, test bulk deactivation, and cut everyone's access at the same agreed time.

Remote employees

Remote offboarding uses the same checklist with three differences:

• Devices: ship a return box with a prepaid label as soon as the date is known, set a deadline in writing, and lock the device if it is late.
• Time zones: agree the cut-off in the employee's local time.
• Documents: send exit documents for e-signature before the video call.

Compliance and record retention

• Access removal. CIS Controls Safeguard 6.2 asks for a process, preferably automated, that disables accounts immediately upon termination, and notes that disabling rather than deleting may be needed to preserve audit trails. ISO 27001 control 5.18 covers removing access rights when employment ends, and control 6.5 covers responsibilities, such as confidentiality, that continue after it. SOC 2 criterion CC6.2 expects credentials to be removed when access is no longer authorized; a common control target is one business day, and auditors ask for evidence it was met.
• Final pay. There is no single US rule. The US Department of Labor says federal law does not require employers to pay a former employee's final paycheck immediately, but some states do. California, for example, requires a discharged employee to be paid all wages, including accrued vacation, immediately at the time of termination. An employee who quits with at least 72 hours' notice is paid at the time of quitting, and one who quits without notice within 72 hours.
• Benefits. COBRA generally applies to employers with at least 20 employees. The employer must notify the plan within 30 days of a qualifying event such as termination, and the plan must send an election notice within 14 days of being notified.
• Records. EEOC regulations require employers to keep personnel records for one year, and for an involuntarily terminated employee, one year from the date of termination. Other laws may require longer; set retention for HR records, mailboxes and files in one written policy.

This is a general summary, not legal advice. Check state and country rules with HR and legal.

Exit interview and knowledge transfer

The exit interview has two jobs. The first is feedback: why the person is leaving and what the team should fix. Keep it with HR, not the direct manager, if you want honest answers. The second is a security briefing: remind the employee in writing of the confidentiality and intellectual property obligations that survive employment, and confirm what they are returning.

Knowledge transfer should start at notice, not in the last week: written handover notes in a team-owned space, recorded walkthroughs of anything only this person knows, and introductions to key customers and vendors while the leaver is still there.

Common offboarding mistakes

• Starting from an email instead of the HRIS. IT hears late, or not at all.
• Disabling without revoking sessions. The person stays signed in on a phone or browser.
• Forgetting apps outside SSO. These are where most leftover access lives.
• Deleting too early. Files, mailboxes and audit trails disappear before ownership is transferred.
• No owner after the last day. Devices, licenses and COBRA notices drift because nobody owns Phase 4.
• Not recording completion. Without a ticket trail, you cannot show an auditor what was done and when.

How to automate the checklist

The reliable version of this checklist starts from the HRIS. When HR enters a termination date, a workflow should:

1. Create a parent ticket with child tasks for each owner, due relative to the end date.
2. Pull the employee's profile, manager, assets and access inventory.
3. Generate the ownership report two weeks before the end date.
4. Deactivate accounts and terminate sessions at the agreed time.
5. Track every task to completion and keep the record for audit.

Identity providers can deprovision SCIM-connected apps; the gaps are the HR, finance and facilities tasks, apps outside SSO, and the follow-up after the last day. For the tools that run this end to end, see employee offboarding software and which HRIS automates onboarding and offboarding.

How Harmony runs this checklist

Harmony runs offboarding from the HRIS event, inside Slack and Microsoft Teams:

• Employee Offboarding detects an upcoming end date in HiBob, Workday or BambooHR (14 days before by default, configurable), creates a parent ticket with IT child tickets (account termination, VPN removal, factory reset, asset return, ownership transfer, physical access) and HR child tickets (exit interview, final payroll, benefits termination), pre-fills the asset list and notifies the manager when everything is done.
• Employee Account Termination handles urgent cases: an admin or manager requests it in Slack or Teams, approval is routed, and Harmony deactivates accounts in Okta or Microsoft Entra ID and terminates active sessions, with the outcome logged on a high-priority ticket.
• Offboarding Ownership Transfer Report lists the applications, tickets, approvals, desks and agents the person owns so they can be reassigned. It does not reassign them automatically, and it ships disabled until you turn it on.

HR requests run on the same agent through Harmony for HR. Limitations: the scheduled workflows need a connected HRIS, some integrations need extra setup, and each deployment is priced by custom quote, with no self-serve price list (pricing).

This guide is written and maintained by Harmony. Details about other products come from their public pages, listed under Sources, and were last checked in October 2026. It is not legal advice. If something is out of date, email us and we will fix it.