Offboarding is an IT process, and it is usually the weakest one

Onboarding gets attention because someone is waiting and cannot work. Offboarding has no such pressure — nobody is blocked by an account that should have been disabled — so it slips, and the result is access that outlives employment, sometimes by years.

Why it fails

Almost always because IT is told late. HR knows on the Tuesday, the manager knows on the Wednesday, IT finds out when the laptop does not come back. The technical work is trivial; the trigger is the problem.

One reliable fix: make IT’s offboarding task part of the HR process rather than a separate request, created automatically when the leaving date is entered. That single change resolves more offboarding failures than any checklist.

The obvious list

1. Disable the directory account on the last day. Disable, not delete — deletion loses group memberships, mailbox access and the audit trail, and it is frequently irreversible.
2. Revoke VPN and remote access explicitly, since it is often separate.
3. Terminate active sessions and tokens. A disabled account can leave live sessions running for days.
4. Reset or revoke multi-factor enrollments.
5. Collect devices — laptop, phone, tokens, keys, badges — and wipe them before reissue.
6. Handle the mailbox: forward, delegate or convert, per the agreed policy.
7. Transfer file and document ownership, before the account is cleaned up rather than after.

The accounts nobody lists

This is where the real exposure sits, because none of these are in the directory:

• SaaS applications bought by a department.Marketing tools, design tools, project tools — signed up with a corporate card, invisible to IT, and frequently still accessible.
• Personal accounts on business services.A domain registrar, a cloud account, a code repository, an app store, registered in an individual’s name.
• Shared credentials.If a password was known to the leaver and is shared with others, it must change. This is the one most often skipped because it inconveniences people who are still here.
• API keys and service accounts they created.Often running under a personal identity, and often load-bearing. Deleting the account stops a job nobody knew existed; leaving it is credentials with no owner.
• Certificates and SSH keys.Any issued to them, on servers and in repositories.
• Physical accessBadges, alarm codes, key safes, and the door code that has not changed in five years.
• External systemsCustomer portals, supplier systems, partner tools, where the customer or supplier has to remove them and only you know to ask.

Timing, and the case that needs a different plan

For an ordinary leaver, disabling on the last day is correct, and doing it early creates a genuine problem: someone unable to finish their handover.

For a dismissal or a departure in poor circumstances, access is removed at the moment of notification, which needs preparation before the conversation happens. Agree this path with HR in advance — improvising it on the day is how things get missed.

Verify, and find what the process has already missed

A checklist that is never audited drifts. Two checks, quarterly:

• Compare the directory against the HR list. Any enabled account without a current employee is a finding, and there are almost always some.
• Review accounts with no recent sign-in. It catches the SaaS and external accounts the directory comparison cannot see.

The first time either is run it produces an uncomfortable number. That is the point — the discomfort is the measure of how long the gap has existed.

Write down what the person knew

Separate from access, and easy to forget in the rush: what were they the only person who knew? Which supplier did they deal with, which system did only they understand, what was in progress. That belongs in the offboarding process too, because it is discovered otherwise at the worst moment.

Our infrastructure managed services run joiner and leaver processes against the directory with the quarterly reconciliation included, because the accounts that outlive employment are found by the audit, not by the checklist that missed them.