Offboarding checklist: joiner, mover, leaver

Joiner: before day one

• HR record created with the correct start date, department, manager and location.
• Work account created from the HR record, not by hand where you can avoid it.
• Group membership assigned by role, not copied from a colleague.
• Applications assigned through the identity provider so one sign-in reaches them.
• Authenticator or passkey registered at first sign-in, with a second method for recovery.
• Manager confirms access on day one; anything missing is requested through a ticket, with an owner.

Mover: team or role change

Movers are where privilege piles up. The rule is simple: add what the new role needs, remove what the old role gave.

• HR record updated first; access follows the HR record.
• Old group memberships removed on the effective date, not 'later'.
• Old manager confirms hand-over of shared files, mailboxes and approvals.
• Admin and finance roles re-approved by the new manager.
• Change recorded in the audit log.

Leaver: before the last day

• HR notified and last working day agreed.
• List of applications, shared accounts, API keys and service accounts the person owned.
• Hand-over of owned resources to a named person: shared drives, repositories, vendor portals.
• Company devices recovery arranged.
• Shared secrets the person knew are scheduled for rotation.

Leaver: on the last day

• HR marks the person inactive; provisioning removes or disables accounts in connected applications (SCIM sets active to false).
• Active sessions revoked; verify none remain.
• Passkeys, authenticator registrations and recovery methods removed.
• Single sign-on access disabled; confirm sign-in fails.
• Mailbox access converted to delegated access or archive per policy.
• Remote access, VPN and any directly managed local accounts disabled.
• Out-of-office and forwarding rules set per policy.

Leaver: the week after

• Review the audit log for sign-in attempts by the former employee's account.
• Check applications that are not connected to provisioning, and remove accounts by hand.
• Rotate any shared credentials the person knew.
• Review the person's service accounts and API keys; reassign or delete.
• Confirm company devices were returned and wiped.

Retention and records

Decide how long the account, mailbox and logs are kept, and who may access them. Check with your compliance counsel for obligations that apply to you, including under the DPDP Act 2023.

• Retention periods written down for account data, mailbox and logs.
• Deletion scheduled and tested.
• Evidence of the offboarding saved: ticket, timestamps, approver.

Exceptions

• Contractors: set an end date at the start and a sponsor who confirms the end.
• Sudden departures: use the same list, in order, starting with session revocation.
• Rehires: create fresh access; do not revive old group memberships.