ACCESS LIFECYCLE GUIDE
Employee IT onboarding and offboarding checklist
Give every employee the right tools and access on time—and remove that access reliably when responsibilities change.
Employee technology access should follow a controlled lifecycle: requested, approved, created, reviewed, changed and eventually removed. Without that process, new employees lose productive time, existing employees accumulate unnecessary permissions and former staff may retain access to business systems or information.
A practical process connects the manager, human resources or administration, IT support and the person responsible for business data. It should cover employees, contractors, temporary staff, interns and anyone else who receives an account, device, shared password, physical access token or administrative permission.
Start with the person, role and business need
Before creating accounts, record the person’s legal or approved display name, role, manager, start date, work location, employment type and expected end date where applicable. The manager—not the new employee—should approve the applications, shared resources and data needed for the role.
Use a role-based access template as a starting point, then add exceptions with documented approval. Access should reflect least privilege: enough to perform assigned work, but not broad access copied from another employee simply because it is convenient.
The 12-point IT onboarding checklist
Receive an authorized request
Require the manager or approved administrator to submit the start date, role, location, employment status, required systems and equipment with enough lead time.
Assign a unique identity
Create an individual business account using the approved naming standard. Avoid shared user accounts because they weaken accountability and make departures harder to manage.
Provide only required licenses and access
Use an approved role template for email, files, applications, groups, shared mailboxes and line-of-business systems. Document any elevated or exceptional permission.
Configure secure authentication
Require a temporary setup process that does not expose passwords. Register MFA, preferably a phishing-resistant method where supported, and establish controlled recovery options.
Prepare and record the device
Assign a supported device, asset number and responsible user. Apply updates, encryption, endpoint protection, screen lock, approved software and management settings before handover.
Separate user and administrator privileges
Most employees should work without local or cloud administrative rights. When administration is part of the job, use a separate privileged account and appropriate approval.
Configure communication and collaboration
Add the employee to required teams, groups, calendars, phone systems and shared mailboxes. Avoid adding broad groups without confirming that all inherited access is appropriate.
Protect business data
Store work in approved business locations rather than personal email, consumer storage or unmanaged devices. Clarify where client, financial and confidential information belongs.
Explain security expectations
Cover phishing reporting, password and MFA rules, acceptable use, approved software, remote work, data handling and how to request technical support.
Test the working setup
Confirm sign-in, MFA, email, required files, applications, printing, remote access and support channels. Resolve issues before they become first-day delays.
Record acknowledgment and ownership
Document issued equipment, applicable policies, recovery items and who approved access. The business should retain ownership of accounts, subscriptions and business information.
Schedule an early access review
After the employee has started, ask the manager to confirm what is actually required and remove unnecessary temporary, inherited or elevated access.
Do not clone another employee’s access without review
Two people with similar titles may handle different clients, financial duties or confidential information. Copying every permission can quietly create excessive access.
Do not forget role changes
Promotion, transfer, leave, contractor extension and departmental change are access events too. Add the permissions required for the new responsibility, but also remove access that no longer has a business purpose. Review administrative roles, approval authority, shared folders, distribution groups, application roles and physical devices.
Organizations often manage new starters and departures but overlook employees who change roles. Over time this creates “permission accumulation,” where a person retains access from several earlier positions.
The 12-point IT offboarding checklist
Confirm timing and responsibility
Receive the authorized last working date, exact access-removal time, manager, employment circumstances and any special instructions from the appropriate business authority.
Block sign-in and revoke sessions
Disable access at the approved time, reset credentials where appropriate and revoke active cloud, VPN and application sessions. Urgent or involuntary departures may require coordinated immediate action.
Secure authentication methods
Remove registered devices, passkeys, security keys, application passwords, recovery methods and delegated authentication controlled by the departing person.
Remove access across every system
Cover email, Microsoft 365 or Google Workspace, VPN, password manager, finance, CRM, websites, social media, cloud platforms, support tools and industry applications—not only the main directory.
Review privileged and shared access
Remove administrative roles, shared mailbox delegation, group membership, API tokens, service credentials and access to shared accounts. Rotate shared secrets that the person knew.
Protect business email continuity
Decide whether email must be retained, converted to a shared mailbox, monitored or forwarded. Use an approved message for external contacts and avoid giving unrestricted mailbox access without authorization.
Preserve and transfer business data
Identify required email, OneDrive or other files, project records, contacts and calendars before deleting accounts or removing licenses. Apply retention, privacy and legal requirements.
Recover and secure devices
Collect computers, phones, security keys, badges, storage media and other assets. Confirm return condition, preserve required data and securely erase or re-provision equipment.
Transfer operational ownership
Reassign meetings, workflows, vendor contacts, websites, domains, automation, shared numbers, support queues and approval responsibilities to named business owners.
Review recent activity when warranted
Based on risk and authorization, review relevant sign-ins, forwarding rules, administrator changes, downloads and alerts. Preserve evidence if suspicious activity is identified.
Recover licenses and subscriptions
Only after data and continuity decisions are complete, remove or reassign licenses, seats and paid services so costs and access stay accurate.
Verify and close the record
Have a second person confirm that required systems were handled. Record completion time, exceptions, retained data, asset status and any follow-up work.
What the lifecycle record should contain
Official guidance and next steps
Microsoft’s former-employee workflow begins with preventing sign-in, then addresses mailbox preservation, mobile devices, mail handling, access to OneDrive and Outlook data, licenses and account deletion. Its documentation warns that retention behavior and sequencing matter, so data and continuity decisions should be made before removing licenses or deleting accounts.
Review Microsoft’s official former employee removal overview and sign-in blocking and session guidance. Related CommzzTech resources include the Microsoft 365 security checklist, managed IT support guide and phishing and business email compromise guide.
Important: This article provides general information. Employment, privacy, records, legal-hold, monitoring and device-wiping requirements depend on the circumstances and jurisdiction. Obtain appropriate HR, legal, privacy and technical advice before acting.
NEED A REPEATABLE EMPLOYEE IT PROCESS?
Make access timely, appropriate and accountable.
CommzzTech can help document account, device and access workflows appropriate to your team and technology environment.