Digital offboarding: a verifiable checklist when an employee leaves

Let's discuss your project →

Offboarding is not a single action. When a collaborator leaves, the real questions are: has the identity been disabled, are active sessions and refresh tokens still valid, who now owns the files, and which external connections still point to the former user? Microsoft’s guidance separates these controls in Microsoft 365, while Google’s Essentials documentation shows that removing a user does not automatically prove every sharing link or copied file has been neutralized. Microsoft Learn, Google Essentials

What to prepare before you start

Before you begin, collect a minimal offboarding record:

  • the user’s primary identity and tenant or workspace
  • the effective separation date and time
  • the services involved: email, documents, chat, storage, SaaS integrations
  • the internal owner who will receive documents, calendars, and shared assets
  • the systems that may keep sessions alive, such as browser sessions or mobile clients

This preparation matters because password changes, sign-outs, and access blocks do different jobs. Microsoft documents a distinction between blocking sign-in, signing out of sessions, and related account actions; it also notes that some changes may take time to propagate across the service. Microsoft Learn

A practical 5-step checklist

1) Disable the identity first

Start by preventing new authentication. A password reset alone is not enough if sessions or tokens remain valid. In Microsoft 365, the documented controls include blocking sign-in and signing out of sessions; they are not the same operation. Microsoft Learn

Owner: IT or identity administration

Check: the account can no longer authenticate from a fresh login attempt.

2) Revoke active sessions and token renewal

Modern access often continues through browser sessions and refresh tokens. Microsoft describes refresh tokens as the mechanism that lets a client obtain new access tokens without prompting the user again. That means a former user may keep returning until those mechanisms are invalidated. Microsoft Learn

Owner: IT or security operations

Check: existing sessions are no longer able to renew access after revocation.

3) Reassign ownership of business data

The goal is not just to move files, but to restore clear business ownership. Mailboxes, shared folders, calendars, document libraries, and groups should be assigned to a named internal owner before any deletion or archival step.

Owner: data owner or department manager, with IT support

Check: every critical asset has a current owner inside the company and the permissions match that role.

4) Review sharing, linked apps, and residual access

Access revocation on the account does not automatically erase every external sharing relationship or every third-party connection already granted in the past. In Google Essentials, removing a user changes the account state, but the documentation still warns that transferred files may remain directly shared with the removed user unless sharing is reviewed. Google Essentials

Owner: IT, security, or the application owner

Check: direct shares, external links, OAuth connections, and SaaS integrations are reviewed and either removed or re-approved.

5) Record evidence and close the case

A defensible offboarding process needs timestamps and outcomes. At minimum, record what was done, on which platform, by whom, and when. That record is what lets a later audit show that the workflow was executed, not merely assumed.

Owner: IT, security, or compliance

Check: there is a complete case log with date, time, action, and observed result.

Simulated example

Simulated input:

  • User: former employee in the sales team
  • Separation time: 24 September, 12:00
  • Systems: Microsoft 365 mailbox, shared OneDrive folders, a CRM connection, and a browser session on a personal laptop
  • New owner: sales operations manager

Simulated workflow output:

  • 12:10 — sign-in blocked
  • 12:15 — active sessions revoked
  • 12:25 — shared folders and documents reassigned to the sales operations manager
  • 12:40 — external shares and CRM integration reviewed
  • 13:00 — case log updated with timestamps and results

Simulated acceptance result: the former user cannot start a new session, previous sessions no longer renew, business files have a current owner, and the remaining sharing surface has been checked.

Acceptance checks by role

  • IT / security: verifies that access is blocked and session revocation has been executed.
  • Data owner: verifies that key documents, folders, and calendars have an active internal owner.
  • Compliance or audit: verifies that the process is documented and can be reproduced from the case log.

What this checklist does not promise

This process reduces account-level exposure, but it does not prove that every local copy, exported attachment, or offline screenshot has been recovered. It also does not replace legal or HR procedures. If your environment includes multiple tenants, external collaboration platforms, or identity providers, repeat the same logic for each system rather than assuming a single action covers all access.

The practical rule is simple: do not treat a password change as proof of revocation. Ask four separate questions instead: is the identity blocked, are sessions and tokens revoked, has ownership been reassigned, and have residual shares been checked? If the answer to any of them is unclear, the offboarding is not finished.

Sources