Offboarding is usually owned by whoever is least busy on the day, executed partially, and never verified. The result appears in nearly every access review we run: accounts still active, tokens still valid, and shared passwords still in circulation.

Day one, in order

  • Disable the account in your identity provider — this cascades to everything behind single sign-on.
  • Revoke active sessions and refresh tokens explicitly. Disabling an account does not always terminate live sessions.
  • Remove them from shared mailboxes, groups, and distribution lists.
  • Reassign ownership of documents, calendars, and any resource they own.
  • Collect devices, or trigger a remote wipe of company data on personal ones.

Rotate what they knew

Any shared credential the person had access to must be changed, not merely transferred. This includes service accounts, shared platform logins, API keys they generated, Wi-Fi keys where those grant meaningful access, and door codes. Reassigning ownership of a password they memorised achieves nothing.

Look outside the approved stack

People sign up for tools with company email, connect integrations, and create accounts nobody catalogued. Check your identity provider's list of connected applications, review the credentials in their password manager vault before removing it, and search billing records for subscriptions in their name. Vendor accounts registered to a departed individual become a genuine operational problem later.

Special handling for elevated access

For administrators, developers, and anyone with production access, extend the checklist: remove SSH keys and deploy keys, revoke cloud credentials and personal access tokens, remove them from code repositories and CI systems, and check for automation running under their personal credentials. That last item causes outages when missed, which is frequently how it is discovered.

Verify, a month later

Have someone other than the person who performed the offboarding confirm each item, a month after the fact. This is where incomplete work surfaces, and building the check into the process is the only reliable way to keep the checklist honest under time pressure.