An employee’s final day arrives. They return their laptop, hand over their office key, and say goodbye to the team.
It may feel like the process is complete.
But what happens to their email? What about the files saved in their cloud account, the applications they used, or the company information stored on their phone?
Returning a device is only one part of employee offboarding. Businesses must also remove access, protect company information, transfer important work, and decide how long accounts and files should be retained.
Without a defined IT offboarding process, former employees may continue to have access to sensitive systems. Businesses may also delete accounts too quickly and lose important emails, customer records, project files, or account information.
Employee IT offboarding is the process of removing a departing employee’s access to company devices, applications, accounts, networks, and information.
A complete process may include:
The process should involve more than the IT department.
Human resources, the employee’s manager, company leadership, and IT should understand their responsibilities before an employee leaves.
Not automatically.
An employee may still be signed in on a laptop, smartphone, tablet, browser, email application, or home computer. Changing one password may not close every existing session or remove access to every application.
That is why IT should receive advance notice of the employee’s departure whenever possible.
For a planned departure, HR and IT can agree on the exact time access should be removed. For an unexpected or immediate separation, the process may need to happen before or during the employee’s departure meeting.
The goal is to avoid a gap between the employee leaving and their access being removed.
A departing employee may have access to more company information than their manager realizes.
Depending on their role, that information could include:
This is why relying on someone’s memory is not enough. Businesses need an updated record of the devices, applications, licenses, and permissions connected to each employee.
Usually, the account should be secured before it is deleted.
Blocking access and deleting an account are not the same thing.
When access is blocked, the former employee can no longer sign in, but authorized employees may still be able to preserve or transfer important information.
Deleting the account too early may create problems if the business later needs:
For Microsoft 365 environments, Microsoft’s current offboarding process separates blocking sign-in, preserving mailbox contents, managing mobile devices, forwarding email, transferring OneDrive access, removing licenses, and deleting the user.
Before deleting an account, the business should confirm that required data has been transferred and that any retention requirements have been reviewed.
A former employee’s email often contains information the business still needs.
Customers, vendors, and business partners may continue sending messages to that address after the employee leaves. Important conversations may also be stored in the mailbox.
Depending on the platform and the company’s needs, IT may:
Access should only be given to people who have a legitimate business need. HR or legal guidance may also be necessary when a mailbox contains private, sensitive, or regulated information.
Important business files are often saved in an employee’s personal cloud workspace rather than a shared company folder.
This can create a problem when the employee leaves.
Before an account is removed, the employee’s manager and IT should identify:
The goal is not to save every file forever. The goal is to prevent useful company information from disappearing because no one reviewed it before the account was deleted.
Personal phones create another layer of concern.
An employee may have company email, Teams, Slack, cloud storage, customer records, or authentication applications installed on their device.
Employee offboarding should determine whether IT can remove company information without affecting personal photos, messages, or applications.
The available options depend on how the device was configured. A business using mobile device management may be able to remove only the company-managed portion of the device. Without that separation, removing business information may be more difficult.
Businesses should define their mobile device expectations before employees begin using personal devices for work. Waiting until someone leaves makes the process harder for everyone involved.
Employee offboarding works best when responsibilities are clearly divided.
Human Resources
HR should notify the appropriate people about:
The Employee’s Manager
The manager should identify:
The IT Team or IT Provider
IT should handle:
No single department should have to guess what the others have completed.
Use this checklist as a starting point for your company’s process.
Before the Employee Leaves
When Access Is Removed
After the Employee Leaves
An incomplete process can create both security and operational problems.
Former Employees May Retain Access
An account that remains active may still provide access to company email, files, customer information, or internal systems.
CISA has reported an incident in which a threat actor used a compromised account belonging to a former employee. The advisory recommends a consistent user-management process that removes access for offboarded employees.
Important Information May Be Lost
Deleting an account before files and messages are reviewed can remove information that another employee needs to continue the work.
Customers May Not Know Who to Contact
Without email forwarding or an automatic reply, customer messages may sit unanswered in an inactive mailbox.
Businesses May Continue Paying for Unused Licenses
Software accounts may remain active for months when no one is responsible for removing or reassigning them.
Shared Passwords May Remain Unchanged
When employees know passwords to shared accounts, those passwords should be changed when the employee leaves.
The best time to improve employee offboarding is before the next employee leaves.
Start by creating a process that connects onboarding, role changes, and offboarding.
Every employee should have a record of:
When an employee changes roles, their access should also be reviewed. Someone moving from finance to another department may no longer need access to payroll or accounting information.
Regular access reviews make offboarding easier because the company already knows which systems each employee uses.
Employee changes should not create unnecessary security risks or interrupt daily work.
PCS helps businesses manage employee accounts, Microsoft 365 access, company devices, software licenses, cloud services, and cybersecurity protections as part of an organized IT process.
When a company notifies PCS that an employee is leaving, the appropriate access can be reviewed, removed, transferred, and documented based on the organization’s needs.
This gives managers a clearer process while helping protect company information from being lost or accessed by the wrong person.
Employee departures are a normal part of running a business. Losing access to important files or leaving an account active does not have to be.
A clear employee offboarding process helps protect company information, transfer responsibilities, recover equipment, and reduce confusion across HR, management, and IT.
PCS can review your current technology environment, account controls, and employee access procedures to help identify where information or access could be overlooked.
Schedule your Free Network Assessment today and find out where your IT environment may need better visibility, documentation, or protection.
How quickly should a former employee’s access be removed?
Access should be removed at the time established by HR, management, and IT. For an immediate separation, that may mean disabling access before or during the departure meeting.
Can a former employee still access company files after leaving?
They may be able to if their account, active sessions, remote access, or application permissions have not been removed. Blocking the main email account alone may not remove every form of access.
Should a former employee’s email account be deleted?
The account should usually be secured and reviewed before deletion. The company may need to preserve messages, forward new email, transfer files, or meet retention requirements.
Who owns the files created by a former employee?
Business records created or stored in company-managed systems are generally handled according to company policies, employment agreements, privacy requirements, and applicable laws. Companies should consult legal or compliance professionals when ownership or retention is unclear.
What is the difference between disabling and deleting an account?
Disabling or blocking an account prevents the user from signing in while allowing the company to preserve information. Deleting the account begins removing the account and its associated information based on the platform’s retention settings.
Can an IT provider handle employee offboarding?
Yes. An IT provider can disable accounts, remove application access, manage devices, transfer files, preserve email, reassign licenses, and document the completed steps. HR and management must still provide accurate timing and information about the employee’s responsibilities.