An employee gives two weeks' notice. HR collects the badge, processes the final paycheck, and schedules an exit interview. The desk gets cleaned out, the keys are returned, and everyone moves on.
But what about the login credentials? The shared passwords? The cloud apps they set up on their personal phone? The email account that's still forwarding to a personal Gmail?
For most businesses in the Tampa Bay area — and across the country — IT offboarding is an afterthought. That gap is one of the most underestimated security risks a company can carry. A former employee who still has access to your systems, your client data, or your internal communication tools is a liability that doesn't show up on any balance sheet until something goes wrong.
This guide walks you through the IT offboarding checklist most businesses miss, explains why each step matters, and shows how a structured approach — often a key benefit of managed IT services in Tampa — can turn a chaotic process into a repeatable, secure one.
Why Employee Offboarding Is a Cybersecurity Event, Not Just an HR Process
It's easy to think of offboarding as an administrative task. In reality, every employee departure is a security event that needs to be managed with the same rigor as a software vulnerability or a phishing threat.
Consider what a typical employee has access to after even a year on the job: email and calendar, cloud storage like Microsoft OneDrive or Google Drive, internal project management tools, customer relationship management (CRM) platforms, shared team passwords, industry-specific software, and potentially sensitive client or patient records.
None of that access disappears automatically when someone leaves. Unless your IT systems are configured to revoke access in a coordinated, documented way, former employees — whether they leave on good terms or not — may retain the ability to log in, download files, or forward sensitive information long after their last day.
The risk isn't purely malicious, either. A former employee who still receives company emails might inadvertently reply to a client. A shared password that was never rotated might be used by someone who no longer has any business relationship with your firm. These scenarios may sound like edge cases, but they are the kinds of access gaps that emerge routinely at businesses that treat offboarding as a paperwork exercise rather than a security process.
One of the most practical benefits of managed IT services in Tampa is having a team that treats every departure as a structured security event with a defined checklist, not a to-do list assembled in a hurry on someone's last day.
The Core IT Offboarding Checklist: What to Do on Day One of Notice
The moment you know an employee is leaving — whether it's a resignation, a termination, or a planned retirement — the IT clock starts. Here's what should happen immediately, or at minimum before their final day.
Disable or Suspend Active Directory and SSO Accounts
If your business uses Microsoft 365, Azure Active Directory, or a single sign-on (SSO) platform, disabling the user's primary account should be step one. This single action cascades across most connected applications, cutting off access to email, SharePoint, Teams, and any other Microsoft-integrated tools simultaneously.
Important nuance: disable, don't delete — at least not immediately. Preserving the account in a suspended state allows you to access email archives, retrieve files, and respond to any post-departure legal or compliance needs. Deletion should come later, after a defined retention period.
Revoke Access to Cloud Applications
SSO handles the apps connected to your identity provider, but many SaaS tools maintain their own login credentials. Think of project management platforms, accounting software, e-signature tools, HR systems, or industry-specific applications. Each of these needs to be individually audited and revoked.
This is where many businesses discover a shadow IT problem: apps that employees signed up for independently, often with a company email, that IT was never formally told about. A well-maintained software inventory — another benefit of managed IT services for Tampa businesses — makes this audit far faster and more reliable.
Change Shared Passwords Immediately
Shared credentials are a persistent vulnerability in small and mid-sized businesses. If a departing employee had access to a shared admin account, a social media login, a vendor portal, or a Wi-Fi password, those credentials need to be rotated on or before the last day. Document the change and distribute the new credentials only to current, authorized staff.
Recover Company Devices and Wipe Personal Devices
Laptops, phones, tablets, and any other company-owned hardware should be collected before or on the final day. If the employee used a personal device for work — especially if your business has a bring-your-own-device (BYOD) policy — that device should be remotely wiped of company data through your mobile device management (MDM) platform.
Failing to recover or wipe devices is one of the most common oversights in offboarding. A company laptop sitting in a former employee's home office is a physical security risk that no firewall can address.
The Access Audit: Going Deeper Than the Obvious Accounts
Once the immediate steps are handled, a thorough access audit looks beyond the obvious accounts to find the access points that are easy to forget.
Email Forwarding Rules and Delegates
Before disabling an email account, check whether the departing employee set up any forwarding rules or granted delegate access to another account — including a personal email address. This is a surprisingly common way that data continues to leave an organization after someone's departure, often without any malicious intent on the employee's part.
Review the account's mail settings, remove any forwarding rules, and revoke any delegate permissions before the account is suspended.
API Keys, Service Accounts, and Automation Tokens
For businesses that use software integrations, automation tools, or development environments, individual employees sometimes generate API keys or service account tokens tied to their identity. If those tokens aren't revoked, they can continue to authenticate to external systems indefinitely — completely bypassing the account disable you performed on day one.
This step requires a more technical audit and is one area where professional IT support adds significant value. A managed IT provider can systematically check for orphaned tokens and service accounts tied to departing users.
Third-Party App Permissions
Many employees grant third-party applications permission to access their work accounts — calendar integrations, productivity tools, browser extensions, and more. When the account is eventually deleted, those permissions may linger in the third-party system. Review connected apps through your Microsoft 365 or Google Workspace admin console and revoke any third-party access that was granted under the departing employee's account.
VPN and Remote Access Credentials
If your business uses a VPN, remote desktop solution, or any other remote access tool, the departing employee's credentials for those systems need to be explicitly revoked. Don't assume that disabling their primary account handles this — some remote access tools maintain their own credential stores.
Protecting Sensitive Data: Backup, Transfer, and Retention
Offboarding isn't only about locking things down — it's also about preserving continuity and protecting data that belongs to the business.
Archive the Departing Employee's Email and Files
Before suspending or eventually deleting an account, ensure that the employee's email archive and cloud storage files are backed up and transferred to an appropriate owner — typically their manager or a designated successor. This protects the business from losing institutional knowledge, ongoing client correspondence, or files needed for active projects.
In regulated industries — healthcare, legal, financial services — data retention practices are often shaped by industry-specific requirements. Your IT team or managed IT provider can help configure your systems to support appropriate retention periods, though questions about specific legal obligations are best directed to qualified legal or compliance counsel.
Audit File Sharing and Permissions
Did the departing employee own shared folders, shared drives, or collaborative documents? If so, ownership needs to be transferred before the account is disabled, or those files may become inaccessible to the rest of the team. Run a permissions audit to identify files and folders where the departing employee is listed as owner or sole editor.
Check for Data Exfiltration Before the Last Day
For higher-risk departures — particularly in situations involving termination, competitive concerns, or access to sensitive intellectual property — it's worth reviewing activity logs before the employee's last day. Most enterprise cloud platforms log file downloads, email exports, and external sharing events. A spike in download activity or unusual sharing behavior in the days leading up to a departure can be an early warning sign worth investigating.
This isn't about treating every departing employee as a suspect. It's about having the visibility to act quickly if something doesn't look right.
Building a Repeatable Offboarding Process: Where Most Businesses Fall Short
The checklist above is only as useful as the process built around it. Most businesses that experience offboarding-related security incidents don't lack the knowledge of what to do — they lack a repeatable, documented process that ensures it actually gets done, every time, regardless of who's leaving or how quickly.
Create a Written IT Offboarding Runbook
A runbook is simply a documented, step-by-step procedure that anyone on your team — or your IT provider — can follow. It should list every system, every account type, every device, and every data retention step in the order they need to happen. It should also assign ownership: who is responsible for each step, and who verifies it was completed.
For businesses that work with a managed IT provider, the runbook becomes a shared document that the IT team executes in coordination with HR. This is one of the clearest benefits of managed IT services for Tampa businesses: offboarding doesn't depend on one person's memory or availability — it follows a documented, auditable process.
Tie Offboarding to HR Workflow Triggers
The best offboarding processes are triggered automatically when HR records a departure. Whether you use an HRIS platform or a simpler system, the moment a departure date is entered, it should generate a notification to IT with enough lead time to complete every step before the employee's last day. Last-minute scrambles are where steps get skipped.
Conduct a Post-Offboarding Audit
Two to four weeks after a departure, run a follow-up audit to confirm that all access has been fully revoked, devices have been recovered and wiped, and data has been properly archived. This is your safety net — the step that catches anything that slipped through the initial process.
Conclusion: Offboarding Is a Security Discipline, Not a Checklist Item
Employee departures are a normal part of running a business. But the IT implications of those departures are anything but routine. Lingering access, unwiped devices, forgotten API tokens, and unarchived data are the kinds of gaps that can create real exposure — whether through an inadvertent mistake or a deliberate action. The businesses that handle offboarding well aren't necessarily the ones with the biggest IT budgets. They're the ones that treat it as a repeatable, documented, security-first process rather than a last-minute to-do list.
If you're not confident that your current offboarding process covers everything on this checklist — or if you're not sure what systems your employees even have access to — that's a gap worth closing before the next departure lands on your desk. A professional IT security assessment is designed to surface exactly these kinds of blind spots: undocumented access, shadow IT, and missing offboarding controls that leave your business exposed. Get your free IT security assessment and find out where your offboarding process — and your broader IT security — may have gaps worth addressing.