Offboarding: make the access cut the same day

Offboarding fails when HR thinks IT knows, IT thinks the manager opened a ticket, and the employee still has email on a personal phone at dinner.

The fix is not an enormous workflow platform. It is an authoritative signal, a named cutover time, and a checklist that separates blocking access now from preserving and transferring data carefully. NIST SP 800-53’s account-management control expects organizations to disable accounts that are no longer associated with a person within an organization-defined period. For a normal employee departure, the defensible SMB period is the agreed departure time, not sometime next week.

The trigger must be explicit

IT should receive one offboarding record from an authorized HR or ownership contact. It needs:

• Employee or contractor’s legal name and work identity
• Exact date, time, and time zone for the access cut
• Whether the departure is planned, immediate, or potentially hostile
• Manager who will take ownership of mail, files, and business workflows
• Company devices, keys, badges, tokens, and phone numbers assigned
• Any retention, investigation, or legal instructions from authorized counsel or leadership
• Person who can approve exceptions during the cut

Do not put sensitive termination details into a broad ticket queue. IT needs timing and authorized instructions, not the employment story.

For an immediate termination, prepare quietly and execute while the employment conversation occurs. For a scheduled departure, do not disable the account the night before and surprise the employee finishing a handoff.

Build the access inventory before the final hour

Your identity provider is the start, not the entire list. Inventory access in layers:

1. Primary identity: Microsoft 365, Google Workspace, on-premises AD, or another identity provider
2. Federated applications: services protected by SSO and automated provisioning
3. Local SaaS accounts: accounting, payroll, CRM, marketing, hosting, domain registrar, support portals
4. Remote and privileged access: VPN, RMM, remote support, firewall, cloud consoles, server admin, SSH keys
5. Shared access: team password vaults, shared mailboxes, distribution groups, API keys, door codes, Wi-Fi credentials
6. Devices and physical access: laptops, phones, security keys, badges, keys, storage media
7. Data and ownership: mailbox, OneDrive or My Drive, Shared Drives, personal network folders, dashboards, automations, calendars

If disabling one Entra or Google account does not close the local password on payroll, put payroll on the checklist. Longer term, forcing SSO for important SaaS reduces these manual misses.

At the cut time: stop new access first

Work from the identity source outward.

1. Block or suspend the primary account. In a hybrid Microsoft environment, make the change at the authoritative on-premises directory so synchronization does not undo your work.
2. Revoke active sessions and refresh tokens. Disabling future sign-in does not always end every existing browser, mobile, or application session immediately.
3. Remove privileged roles and delegated access. Global admin, billing, payroll, DNS, mailbox delegation, and application-owner roles deserve explicit checks.
4. Disable remote paths. Remove VPN, RMM, remote-support, SSH, and administrative console access.
5. Remove password-vault membership. A good team vault removes shared-item access centrally. Our shared-admin-secrets guide covers the ownership model.
6. Disable local SaaS accounts. Confirm that SSO-enforced services actually deny fallback passwords.
7. Contain managed devices. Retire, lock, or wipe company data according to device ownership and the approved procedure. Do not remotely erase a device before confirming whether evidence or business data must be preserved.
8. Recover physical property. Record laptop, phone, security key, badge, office key, and removable-media returns.

Microsoft’s current former-employee process similarly starts by blocking access, then addresses mailbox, OneDrive, mobile devices, forwarding, licensing, and deletion as separate steps. That separation matters. License reclamation is accounting; access revocation is security.

Preserve data before deleting the account

Do not make deletion the first click. Determine who needs the business record and how long it must be retained under company policy and any applicable requirements.

For Microsoft 365, assign approved access to the mailbox and OneDrive data or convert the mailbox according to the documented Microsoft process before deleting the user. Retention behavior depends on license, configuration, holds, and whether the account is merely unlicensed or deleted; do not rely on a remembered thirty-day rule without checking the tenant.

For Google Workspace, Shared Drive content is owned by the organization and remains when a creator leaves. My Drive content is individually owned and needs an explicit transfer decision. Google’s Shared Drive documentation explains the ownership distinction.

Forwarding all former-employee email to a manager is not automatically the right answer. It can expose private or irrelevant messages and create an indefinite shadow mailbox. Use the HR-approved business need, retention policy, and an end date. An auto-reply or role address may solve the customer-contact problem with less access.

Find the access hiding behind the user

The account may own things that keep running after sign-in is blocked:

• Mailbox forwarding and inbox rules
• OAuth grants and application tokens
• Scheduled reports and Power Automate or Apps Script workflows
• Shared mailbox and calendar delegation
• Service accounts whose recovery email or MFA device belongs to the employee
• API keys, SSH keys, and personal access tokens
• Domain, DNS, cloud, social, or advertising accounts registered to the user’s address
• Vendor portals where the person is the only billing or security contact

Transfer ownership; do not blindly delete a production automation. Then rotate any shared credential the departing person knew outside a managed vault. For vendors, replace standing access with the time-bound approach in JIT vendor access instead of a standing VPN.

Verify the cut instead of trusting green checkmarks

Have a second person review the completed runbook. Confirm:

• Primary identity is blocked and sessions were revoked
• Admin roles, groups, shared drives, and delegated mail access were removed
• SSO apps reject access and important local SaaS accounts are disabled
• VPN, RMM, vault, and physical access are closed
• Devices are recovered or have an approved containment action
• Data has an owner and a documented retention decision
• Shared credentials and recovery contacts were handled
• The action record includes who completed and reviewed each step

Check sign-in and audit logs after the cut for attempted access or a missed integration. Do not test by asking for the former employee’s password; verify administrative state and logs.

The next business day

Reclaim licenses only after data and mailbox behavior are understood. Update the directory, phone routing, website, emergency contacts, vendor contacts, and ownership of recurring meetings or workflows. Ask the manager what broke; a forgotten dashboard is easier to repair on day one than at quarter-end.

Finally, close the record with exceptions listed. “Complete except CRM local account, awaiting owner” is actionable. A checked box with an invisible gap is not.

Bottom line

Same-day offboarding starts with an exact HR signal, blocks identity and sessions at the agreed time, and then works through SaaS, remote access, vaults, devices, and data ownership. Disable first, preserve deliberately, delete later, and have a second person prove the access cut actually held.