offboarding access checklist

Disabling someone in the directory closes one door. This list covers the others: sessions, connected apps, local accounts, keys and the tools nobody told IT about. Print it or copy it into your offboarding ticket.

before the last day

Name one person who owns this offboarding end to end, and a date it must be finished.
Ask the person leaving and their manager which tools they used in the last 90 days. Write the list down.
List what they own: shared drives, documents, calendars, automations, repositories, domains. Decide who takes each over.
Find scripts, integrations and scheduled jobs that run under their account or their personal API keys.

on the last day

Disable the account in the identity provider (Google Workspace, Microsoft Entra ID or Okta).
Revoke active sessions and sign-in tokens there too. In Entra ID this is a separate step from disabling.
Remove or reset multi-factor devices registered to the account.
Transfer ownership of files and shared drives before any deletion.
Disable accounts in tools that sit outside single sign-on: check the list from step 2.

the access people forget

Third-party apps the person connected with OAuth. Review them in the admin console of Google Workspace or Microsoft 365.
Personal API keys and access tokens in developer tools, cloud consoles and CI systems.
Shared logins they knew: social accounts, supplier portals, test environments, Wi-Fi. Change the password and record who has the new one.
Admin or owner roles in SaaS tools, including billing owner. A disabled owner can block changes later.
Tools paid for on a company card or expensed. Check card statements for subscriptions nobody else recognises.
Remote access: VPN certificates, SSH keys on servers, cloud access keys.
Mail forwarding rules and delegated mailbox access set up by or for the person.
Their devices: wiped or returned, and removed from device management.

after

Within a week, check sign-in logs for the disabled account and for shared logins it knew.
Record what you removed, when and by whom. One line per system is enough evidence for an auditor.
Add any tool you found today that wasn't on your list to the inventory, so the next offboarding starts from it.

This list documents a process. It doesn't replace one, and it can't tell you whether your setup is secure. If working through it takes days instead of an hour, that's useful information in itself: tell me what you found and I'll point you to options that fit.

offboarding access checklist.

before the last day

on the last day

the access people forget

after