When someone leaves: the offboarding checklist
Most access problems start with a departure nobody fully processed. One checklist, run on the last day, fixes it.
Employees and contractors leave all the time. The account in the main directory usually gets disabled. Everything else is hit and miss: the SaaS tool they signed up for with a credit card, the shared admin password, the personal phone with work email, the API key they created.
A checklist, run on the last working day:
- Disable the directory account and revoke all active sessions and tokens.
- Remove them from SaaS tools that aren’t connected to single sign-on. Keep a list of those.
- Change any shared passwords they knew. The password manager shows which.
- Wipe company data from personal devices, and collect company devices.
- Transfer ownership of files, mailboxes, domains and cloud resources registered in their name.
- Revoke their API keys, SSH keys and personal access tokens.
- Set up mail forwarding to a manager for a limited time, not forever.
HR should trigger it automatically. IT shouldn’t find out a month later.