Employee onboarding and offboarding: an IT checklist

From the helpdesk's point of view, people joining and leaving an organization are two of the most important moments in the IT calendar. A smooth first day sets the tone for a new employee. A clean last day protects your data. Yet both are often handled with a rushed email to IT, sometimes the day before, sometimes after the fact.

I oversee how these requests run at Ceifa, and over the years I have seen most of the ways they go wrong: a new hire sitting at an empty desk waiting for a laptop, a manager who left months ago still receiving client email, a former contractor whose account was never closed in an accounting system nobody remembered. This is the checklist I would want every organization to follow, whoever does the work.

Start with a single request, early

Both processes should begin with one form or ticket, raised by HR or the hiring manager, that holds everything IT needs to know. For a new hire, ideally give IT at least a week or two of notice. For a departure, tell IT as soon as the date is known, and for an involuntary exit, before the conversation happens so access can be removed at the right moment.

The request should include:

• Name, job title, department and manager
• Start or end date and time
• Whether they work in the office, remotely or both
• Which existing person their role is most similar to, for access purposes
• Any specific systems, equipment or phone numbers they need or are giving up

That "similar to" question saves a lot of time, but be careful with it. Copying a long-serving colleague's access often copies years of permissions they picked up along the way. Role-based templates are better: a defined set of groups and applications for each kind of job.

Onboarding checklist

Accounts and identity

• Create the user account with a consistent naming format.
• Add them to groups based on their role template, not by hand.
• Set up multi-factor authentication on day one, ideally in person or on a call with IT, so it is done properly and not skipped.
• Create accounts in line-of-business applications, such as accounting, CRM, scheduling or practice management software.
• Set up phone extension or calling, voicemail and any shared inboxes they need to monitor.

Devices

• Prepare the laptop or desktop before the start date, enrolled in your device management and security tools, fully updated and encrypted.
• Record the device against the person in your asset list, including serial number.
• Arrange monitors, docks, headsets and mobile phones if needed.
• For remote staff, ship early and schedule a setup call.

Licences

• Assign only the licences the role needs. Check you have one available before the start date rather than finding out on the day.
• Record who has which paid licence, so you can reclaim it when they leave.

First day

• A short walkthrough: how to sign in, where files live, how to get IT help, what to do with a suspicious email.
• Enrol them in security awareness training.
• Building access cards, alarm codes and printer access.
• A check-in at the end of the first week to catch anything missing.

Offboarding checklist

Offboarding is where the real risk sits. A forgotten account belonging to someone who has left is invisible to everyone, and that is exactly what makes it useful to an attacker or a disgruntled former employee. Unused accounts are not watched, nobody notices odd sign-ins, and the password may have been reused somewhere that was later breached.

At the moment of departure

• Disable the user's sign-in. Disable first, delete later, so data and mailbox content can be handed over.
• Sign them out of all active sessions on every device. Disabling an account does not always end a session that is already open.
• Remove their multi-factor methods and any registered devices.
• Remove their remote access, such as VPN or remote desktop.
• Change the passwords of any shared accounts they knew: social media, vendor portals, Wi-Fi, alarm codes, shared admin logins.

For an involuntary departure, coordinate the timing with HR so access is cut while the meeting is happening, not after the person has returned to their desk.

Email and data handover

• Decide with the manager who takes over the mailbox. Common options are giving the manager access, forwarding new mail for a defined period, or setting an automatic reply that points to a new contact.
• Move files out of the person's personal storage into a shared location the team owns, before anything is deleted.
• Check for anything only they owned: shared calendars, distribution lists, automated workflows, scheduled reports.
• Set a date for when the account will be removed and the data archived according to your retention needs.

Devices

• Collect the laptop, phone, tokens, access cards and any other equipment against the asset list.
• Remove company data from personal phones that had work apps.
• Wipe and reissue, or retire, the device. Keep a record of what happened to it.

Licences and third-party systems

• Reclaim paid licences so you stop paying for them, or reassign them to the next hire.
• Remove the person from line-of-business applications, banking portals, payroll, supplier websites, domain registrars and any other service where they had a login.

That last point is where most organizations fall short. Staff sign up for cloud tools with their work email all the time, often without IT knowing. A useful habit is to ask the departing person and their manager directly: which services did you log in to for work? The answer is often surprising.

Do not forget people who change roles

When someone moves from one department to another, they tend to gain new access and keep all the old access too. Over a few years, long-serving staff can end up with access to far more than their job needs. Treat a role change as a small offboarding from the old role and a small onboarding to the new one, and review access at least once a year for everyone.

Make it repeatable

The goal is that none of this depends on someone remembering. A written checklist, a standard request form and role templates mean the process is the same whether the request reaches IT on a quiet Tuesday or during a busy week. Each completed request should leave a record: who asked, what was done, when. That record is what you will want if you ever need to show that a former employee's access was removed.

Frequently asked questions

How much notice does IT need for a new hire?

Give IT at least a week or two where you can. That allows time to order or prepare a device, confirm licences are available and set up access in every application before the person arrives.

Should we delete a departing employee's account straight away?

Disable it straight away, but do not delete it until email and files have been handed over. Deleting too early can lose data the business still needs.

Why is slow offboarding a security risk?

An active account belonging to someone who has left is rarely monitored. If the password is guessed, reused or stolen, an attacker can use it without anyone noticing, and the former employee may still have access to company data.

What is the most commonly missed step?

Removing access to third-party services and shared accounts. Systems outside the main sign-in, such as supplier portals and social media, are easy to forget.

How Ceifa handles joiners and leavers

Onboarding and offboarding are part of the device and user lifecycle work in our managed services. We work from a standard checklist, prepare devices before day one through our hardware procurement service, and keep a record of every change. If your joiners and leavers process lives in someone's head today, talk to us about putting it on a firmer footing.