Confirm the departure details
A clear request should identify the employee, last day, manager, device status, and systems that may require a handoff. The manager or approved internal contact should make the business-continuity decisions before IT changes access.
- Confirm the final working date and approved timing for access changes.
- Identify email, shared mailboxes, files, property platforms, accounting tools, vendor portals, and remote access.
- Document who should receive mailbox, file, calendar, or workflow ownership.
- Decide how active requests, vendor conversations, property contacts, and external communications will be reassigned.
Remove access in a deliberate order
The goal is not only to disable one account. It is to close the paths the employee could still use while preserving the approved information the business needs.
- Disable sign-in, reset relevant passwords, and revoke multi-factor authentication access.
- Remove access to shared mailboxes, file locations, property applications, accounting systems, and vendor portals.
- Review shared credentials and role-based accounts that may need to change after the departure.
- Revoke active sessions, application tokens, mobile access, and remote connections where the platform supports it.
Recover devices and document the result
Device recovery and documentation make the next staffing change easier and reduce future uncertainty. Do not reassign equipment until the approved record, access, and retention decisions are complete.
- Coordinate return, wipe, reassignment, or secure storage of company devices.
- Preserve approved business records according to company policy.
- Record the completed changes and any remaining vendor or manager decisions.
- Update device inventory, software licensing, group membership, and the named owner for any retained account or workflow.
Questions to ask
Should offboarding happen before or after the employee leaves?+
Timing depends on the company’s approved process. Access and business continuity decisions should be coordinated with the employee’s manager and HR or leadership.
What about shared mailboxes?+
Shared mailbox ownership, access, forwarding, and retention decisions should be assigned to a responsible manager before access is removed.
What if an outside vendor controls part of the access?+
Identify the vendor contact and account owner early. Record the request, expected timing, and confirmation so third-party access removal does not remain an undocumented assumption.
