Employee onboarding and offboarding: the IT checklist that prevents data leaks
New colleagues should be productive on their first morning, and former colleagues should lose access on their last afternoon. Both sound obvious, yet in small companies the first often takes a week and the second sometimes never happens. A simple checklist, used every time, solves both problems.
Before the first day
- Get the details from HR: name, role, manager, start date and which teams they join.
- Create the account in Microsoft 365 or Google Workspace with a naming standard, and assign the right license.
- Add groups and permissions based on the role, ideally by copying a role template rather than another person’s account, which brings unwanted permissions along.
- Prepare the device: install the standard software, enable disk encryption, enrol it in device management and register it in your inventory.
- Set up access to line-of-business apps, shared mailboxes, VPN and the password manager.
- Prepare a welcome note with how to sign in, how to set up multi-factor authentication and how to contact support.
On the first day
- Walk the person through MFA setup and the first sign-in.
- Show where files live and how sharing works.
- Explain the three security rules that matter most: never share passwords, check sender addresses, report anything strange.
Offboarding: on the last day
- Block sign-in and reset the password at the agreed time, not weeks later.
- Revoke sessions and app passwords, so phones and laptops that are already signed in lose access too.
- Remove MFA methods registered by the person.
- Convert the mailbox to a shared mailbox or set up forwarding to the manager, depending on your policy and local law.
- Transfer files from OneDrive or Google Drive to the manager or a team folder.
- Remove access to every other system: CRM, accounting, VPN, password manager, social media accounts, domain registrar and hosting.
- Collect devices, wipe them and update the inventory.
- Free the license so you stop paying for it.
The steps companies forget
- Shared passwords the person knew, such as Wi-Fi, the office alarm or a shared social media login. Change them.
- Accounts created with a personal email address in third-party tools.
- Mobile phones with company mail that are not managed.
- Scheduled tasks or integrations that run under the person’s account and stop working when it is disabled.
Make it a habit
Keep the checklist as a ticket template so nobody depends on memory, and ask HR to open the ticket at least three working days before a start date and as soon as a leaving date is known. Onboarding and offboarding are included in our L1–L2 Business helpdesk plan, and every request is tracked as a ticket.