What should IT verify before starting an employee offboarding workflow?

An employee offboarding checklist for IT should begin before administrators disable an account, revoke a session, or lock a device. Premature action can interrupt business operations, erase needed evidence, or alert an employee before the approved departure time.

A pre-execution review gives IT a verified scope, authorized timeline, and defensible record for every offboarding action. The following checks help prevent identity errors, missed access paths, unmanaged devices, and unclear ownership.

Confirm the employee’s identity

Match the offboarding request to a unique employee record. Names alone are unreliable, especially in large organizations or environments with contractors, shared mailboxes, and multiple identity domains.

Verify:

• Full name and employee or contractor ID
• Department, manager, and work location
• Primary email address and username
• Employment type and legal entity
• Known aliases or duplicate directory records

If any identifier conflicts with HR or identity records, pause the process until the discrepancy is resolved.

Verify timing and authorization

Confirm exactly when access changes may begin and who authorized them. The effective time may differ from the employee’s final working day because of time zones, scheduled shifts, garden leave, or an immediate termination.

The request should identify the approving authority, such as HR, Legal, the employee’s manager, or an authorized security lead. High-risk or involuntary departures may also require a confidential workflow with restricted visibility.

Do not infer timing from a meeting invitation or informal message. Record the approved date, time, time zone, and any required action sequence.

Build a complete account inventory

Create an inventory of the employee’s access before changing anything. Start with the primary identity provider and directory, then identify downstream accounts that may not be governed by centralized provisioning.

Review:

• Corporate email and collaboration platforms
• SaaS applications and locally managed accounts
• VPN, Wi-Fi, remote desktop, and privileged access
• Cloud consoles, repositories, and developer tools
• Shared, service, emergency, and vendor accounts
• Physical access systems and building credentials

Pay particular attention to accounts created outside standard onboarding. Expense tools, departmental SaaS applications, and third-party portals are common sources of residual access.

Identify assigned devices and active sessions

Compare asset records with device management, security, and authentication data. The employee may use more devices than the asset register shows, including replacement hardware, shared workstations, or personally owned devices enrolled for work.

Document corporate laptops, desktops, phones, tablets, removable media, security keys, smart cards, and other authentication hardware. Also identify active browser, application, VPN, and cloud sessions that may remain valid after a password change.

At this stage, inventory devices and sessions without remotely locking, wiping, or resetting them unless an approved incident-response procedure requires immediate containment.

Resolve ownership and continuity requirements

Determine what must happen to business data and resources owned by the departing employee. Mailboxes, calendars, documents, dashboards, repositories, automations, and recurring meetings may require reassignment.

Confirm the approved recipient for each resource and distinguish ownership transfer from unrestricted access to the employee’s data. Legal, privacy, retention, and investigation requirements may limit what a manager or successor can receive.

Record exceptions and preservation needs

Ask whether the departure involves litigation hold, investigation, insider-risk concerns, regulated records, or another preservation requirement. These conditions can change the order of operations and may prohibit deletion or device wiping.

Document approved exceptions, temporary access requirements, unavailable devices, and dependencies that cannot be transferred immediately. Each exception should have an owner, justification, expiry condition, and follow-up action.

Final pre-execution decision

Before offboarding begins, IT should have a verified identity, authorized timestamp, complete access and device inventory, confirmed ownership plan, and documented exceptions. A final peer or approver review is especially valuable for privileged users and high-risk departures.

This preparation turns offboarding from a sequence of reactive account changes into a controlled security process. Once every prerequisite is confirmed, administrators can execute the approved actions consistently and preserve a reliable audit trail.

Hexnode Synapse reflects a broader approach to coordinating IT and security workflows across enterprise environments.