IT Onboarding and Offboarding Checklist for Employees

The short answer

IT onboarding and offboarding are the same list walked in two directions. If you know exactly what you gave someone, you know exactly what to take back. So the core rule is simple: everything issued to an employee is recorded in one place — a spreadsheet, a ticket system or your HR system.

Without that list the usual picture looks like this: the new hire waits a week for access, and a former employee can still log into the CRM or shared drive a month after leaving.

What to prepare before day one

The request to IT should come from the manager or HR in advance, with job title, department and start date. A role template helps: a sales manager needs one set of systems, an accountant another.

Accounts:

• company email and an account in your main platform (Google Workspace, Microsoft 365 or a local domain);
• messenger and team chats;
• CRM, accounting, task tracker and other role-specific systems;
• a password manager with access to the right shared vaults.

Devices:

• a laptop or PC with a current OS, updates, antivirus and disk encryption;
• phone, headset, monitor, access badge — where applicable;
• an entry in the equipment register: model, serial number, assigned to, date.

Access and licenses:

• permissions by role only — the principle of least privilege, no "give them admin so they stop asking";
• shared folders, mailing groups, VPN, Wi-Fi;
• paid licenses — track who holds them so you do not forget them later.

Day-one checklist

Send the temporary password separately from the username and require a change on first sign-in.

Offboarding checklist

Offboarding starts not on the last day but as soon as the leaving date is known.

Before departure:

• agree with the manager who takes over mail, files, clients and tasks;
• move files from personal folders to shared ones or transfer document ownership;
• find out which external services the person can access: company social accounts, ad accounts, domains, hosting.

On the last day:

• suspend (do not delete yet) the main account — with SSO this cuts sign-in to many connected services at once;
• sign out all active sessions on every device;
• disable VPN, remote access and the badge;
• remove them from work chats and groups;
• change shared passwords they knew: Wi-Fi, shared accounts, vaults;
• collect the laptop, phone and accessories against the handover form.

After departure:

• set up an auto-reply or forward mail to the responsible person;
• free up licenses and reassign them;
• delete the account after the agreed period, following your data retention rules;
• make sure the device is wiped before it is issued again.

Common mistakes

• Deleting the account right away. Mail and files go with it. Suspend and hand over data first.
• Forgotten external services. An ad account or domain registered to the employee's personal email is a frequent problem. Register everything to company addresses.
• Shared passwords never changed. A Wi-Fi password known to a former employee stays an open door.
• No equipment register. Without a record of what was issued, asking for it back is hard.
• Permissions pile up. When people move between teams, old access is forgotten. Review permissions periodically.

How to make it easier

• Use single sign-on (SSO): one suspension closes most access.
• Grant permissions through groups, not person by person.
• Keep role templates and update them whenever a new system appears.
• Automate requests: an HR form creates an IT ticket with the checklist already attached.