Employee Offboarding IT Checklist for Small Businesses

November 10, 2026 · Lizzard Solutions

employee offboardingIT checklistcybersecuritysmall businessMicrosoft 365Google Workspace

By Nemanja Vukmirović, Lizzard Solutions. Last updated 10 November 2026.

An employee hands in their notice, you shake hands on the last day, and three months later their old mailbox is still receiving customer invoices. Or the only admin login for your website was in their name. In small teams, access usually leaves much later than the person does.

This employee offboarding IT checklist closes that gap. You get a printable checklist split into four time windows, the exact Microsoft 365 and Google Workspace steps to look for, a list of the accounts people forget, and a worked example for an eight-person team.

---

What Is an Employee Offboarding IT Checklist?

An employee offboarding IT checklist is a step-by-step list of every account, device, password and file you must disable, recover, transfer or change when someone leaves your company. It makes sure the person loses access on time, the business keeps its data and customers, and nothing depends on a login that no longer has an owner.

The UK NCSC Small Business Guide treats strong passwords and two-step verification as basic protections for small businesses. A departing employee is the moment those controls get tested.

Action for today: list the people who left in the last year and check whether any of their accounts can still sign in.

---

Start With an Access Register (Before Anyone Leaves)

You cannot remove access you do not know about. An access register is a simple sheet with one row per system. It is the single document that makes offboarding fast.

This table is example data. Replace the rows with your own systems. If you use a password manager, its sharing list is a good starting point.

Action for today: create the sheet with your ten most important systems and fill in who has access to each.

---

The Employee Offboarding IT Checklist (Printable)

Work through the four windows in order. Tick each box and write the date next to it, so you have a record if anything is questioned later.

1. Before the last day

• ☐ Confirm the last working day and the exact time access ends.
• ☐ Pull the person’s rows from the access register and add anything missing.
• ☐ Ask them to hand over open work: files on personal drives, passwords they created, customer threads in progress.
• ☐ Pick a new owner for their mailbox, files, calendars and recurring tasks.
• ☐ Check that a second admin exists on every system where they are an admin.

2. On the last day (within the hour of leaving)

• ☐ Block sign-in to email and the office suite, and sign them out of all sessions.
• ☐ Reset the account password and remove their MFA methods so old devices stop working.
• ☐ Remove them from the website, hosting, CRM, accounting and social media accounts.
• ☐ Change every shared password they knew: Wi-Fi, shared mailboxes, alarm codes, supplier portals.
• ☐ Collect the laptop, phone, keys, badges and security keys.

3. In the first week

• ☐ Set up mail forwarding or an auto-reply so customers reach the new owner.
• ☐ Transfer files and shared drives to the new owner.
• ☐ Check mailbox rules and external forwarding they may have created.
• ☐ Back up the device, then wipe it before giving it to someone else.
• ☐ Remove company data and the work profile from any personal phone they used.

4. After 30 days

• ☐ Review sign-in logs for any attempt on the old account.
• ☐ Delete or archive the account and free the paid licence once the data is safe.
• ☐ Update the access register and note what took longest, so you fix it before next time.

Action for today: print the checklist and store it with your incident response plan template, because a rushed or hostile departure is handled the same way as an incident.

---

How to Offboard in Microsoft 365 and Google Workspace

Both suites have an official process. Follow the vendor steps rather than improvising, since menus change. If you are still choosing a platform, see our comparison of Microsoft 365 vs Google Workspace for small business.

Microsoft 365

Microsoft’s guide to removing a former employee walks through blocking access, securing data, and giving colleagues access to the former employee’s email and OneDrive. In practice: block sign-in and sign out sessions, reset the password, convert or delegate the mailbox, move OneDrive content, and only then remove the licence.

Google Workspace

Google’s help page on deleting or removing a user explains the difference between suspending and deleting a user and how to transfer their data before deletion. Suspend first, transfer Drive files and calendars to the new owner, route their address to a colleague if needed, then delete when you are sure nothing is missing.

Action for today: check who in your company has admin rights in the suite. You want at least two, and nobody who has left.

---

The Accounts People Forget

Email gets handled. These usually do not, because they sit outside the office suite or were set up by one person years ago:

• Domain registrar and DNS: if renewal emails or the 2FA code go to a former employee, you can lose the domain.
• Hosting, website CMS and plugins: old admin users are a common way into small business sites.
• Social media pages and Google Business Profile: make sure the company, not a person, is the owner.
• Banking, eFaktura (SEF) and payment providers: qualified certificates and tokens are personal. Revoke them through the issuer.
• SaaS tools paid by card: design tools, newsletter platforms and AI subscriptions often sit on a personal login.
• Physical access: door codes, alarm PINs and parking cards.

This is also where multi-factor authentication can work against you: if the only MFA device is the former employee’s phone, you are locked out. Our guide to multi-factor authentication for small business shows how to register backup methods owned by the company.

Action for today: log in to your domain registrar and confirm the contact email and 2FA device belong to the company.

---

Personal Data, Devices and the Law in Serbia

The former employee’s mailbox and files often contain personal data of customers and of the employee. Under the Serbian Law on Personal Data Protection (ZZPL), you need a lawful basis for keeping that data and should not keep it longer than necessary. Our guide to the Serbian data protection law for websites covers the basics.

• Keep business records you are legally required to keep, and decide a retention period for the rest.
• Do not read the former employee’s private messages without a clear policy and a legitimate reason.
• Wipe returned devices only after the business data is backed up.

This section is general information, not legal advice. For specific cases, ask a lawyer.

Action for today: add one line to your employee handbook saying company accounts and devices are for work and are recovered on departure.

---

Worked Example: An Eight-Person Agency

Here is how a typical offboarding plays out for an example agency with eight people on Google Workspace. The designer, Ana, leaves on Friday.

Action for today: pick the role in your company that would be hardest to offboard and fill in its register rows first.

---

Make the Next Offboarding Easy

• Give access by role, not by person, and keep admin rights to two or three people.
• Store shared passwords in a company password manager instead of chats or notebooks.
• Register company-owned backup MFA methods on critical accounts.
• Run the checklist in reverse when someone joins: every account you create goes straight into the register.

These habits are part of a broader cybersecurity plan for small business. Offboarding is simply where weak habits show first.

---

FAQ

What should be on an employee offboarding IT checklist?

It should cover disabling sign-in, resetting passwords and MFA, removing access to every business system, changing shared passwords, recovering devices, transferring email and files to a new owner, checking forwarding rules, and deleting the account later. Each item gets a date and the name of the person who did it.

Should I delete or suspend a former employee’s account?

Suspend or block it first. That stops sign-in immediately but keeps the mailbox and files, so you can transfer what the business needs. Delete the account only after the data is safely moved, usually after a few weeks, which also frees the paid licence.

How quickly should access be removed when someone leaves?

Ideally at the moment their employment ends, for example within the hour of leaving on the last day. For a sudden or difficult departure, do it before or during the exit conversation. Waiting days gives old devices and saved sessions time to keep syncing company data.

What about employees who used their personal phone for work?

Remove the company account and work profile from the phone, and sign them out of work apps from the admin console. If they used the phone for MFA, remove that method from their account and from any shared accounts. A written device policy makes this easier to agree on.