Guide · Offboarding

Employee offboarding checklist: same-day access removal

By Christopher Smith, MS Cyber Security, penetration tester·Published October 18, 2026·Updated October 18, 2026·5 min read

Someone leaving is not just an HR event. Until you disable their accounts, that person may still be able to read email, open client files, approve payments, or sign in from home that night. The Short gives the 15-minute version; this guide expands it into an owned, repeatable checklist you can run the same day — and improve before the next departure.

Quick verdict

• Disable first, tidy later. Email/Microsoft 365 or Google Workspace, the password vault, and any admin access go first — the same day, ideally within the first hour of the decision taking effect.
• Rotate what they could see. Removing a person from a vault does not change shared passwords they already viewed or copied. Rotate those logins.
• Assign owners, not good intentions. Write down who disables, who collects devices, and who confirms — then keep the record.

The same-day checklist (in order)

1. Identity first: disable (do not immediately delete) their email/Microsoft 365 or Google account, revoke active sessions and refresh tokens, and reset the password. Keep the mailbox available for a manager-approved handover or legal hold if you need it.
2. Password vault: remove them from the team vault and every shared folder. Note every shared login they could view — those passwords get rotated, starting with finance, admin, and client-facing systems.
3. Money systems: revoke banking, payroll, accounting, payment-processor, and expense access. Confirm who now approves payments so work does not stall.
4. Cloud and SaaS apps: work through your app list — file storage, CRM, helpdesk, scheduling, social, website/admin tools. Remove named accounts; do not rely on 'they probably never used it.'
5. Devices: collect laptop, phone, keys, badges, and hardware security keys, or remotely wipe company data from a personal device under your agreed policy.
6. Forwarding and ownership: transfer file ownership, reassign open tickets/customers, and set any email forwarding or auto-reply only as approved by a manager — time-limit it and record it.
7. Confirm in writing: the owner of each step initials and dates it. Store the completed checklist where the next manager can find it.

What teams commonly miss

• Shared logins that were never rotated — the vault entry is gone, but the password itself is unchanged.
• Personal email or phone still set as a recovery factor on a business account.
• API tokens, app passwords, and connected third-party apps that survive a password reset. Revoke them explicitly.
• Local files and browser-saved passwords on a device you have not yet collected. Collect or wipe promptly; see our guide on why browser-saved passwords are not a business vault.
• Deleting the account too fast and losing files, history, or a mailbox you still need. Disable first; delete later on a documented schedule.

Make the next exit faster

Keep a one-page offboarding form tied to your onboarding list: every account created for a new hire should appear on the list you later revoke. Review the form after each departure, add anything you discovered mid-process, and store a blank copy with your password manager rollout notes. Pair this with MFA for Microsoft 365 so a disabled account plus strong MFA protects you while you finish the tidy-up.

Bottom line

Disable first, tidy later. Email/Microsoft 365 or Google Workspace, the password vault, and any admin access go first — the same day, ideally within the first hour of the decision taking effect. The expanded steps above turn the Short's rule into a process with an owner and a check — do the first section today, schedule the rest this week, and write down what you changed so the next person does not have to rediscover it.

Free next step: Get the Small Business Cybersecurity Checklist — download it now, or sign up there to get it by email and hear about new guides.