Updated 4 November 2026 by Simon Mestdagh, founder of Caspian.

Key takeaways

• The template has 28 steps in four phases, each with an owner and an evidence column.
• IT closes three layers, namely apps on the laptop, the account in each app, the resources inside each app.
• Dismissal: close access at the moment the person is told, admin rights first.
• Download the free CSV; it opens in Excel and Google Sheets.
• Offboarding is finished when every step has evidence.

An IT offboarding checklist lists every step IT takes when a person leaves: get the laptop back, close each account, and hand over what the person owned inside each app. This template has 28 steps in four phases, an owner and an evidence column per step, and a free CSV that opens in Excel and Google Sheets.

Caspian publishes this template and sells a product in this space: Caspian, the IT automation platform for scale-ups. Facts were checked on 4 November 2026.

Download the template: it-offboarding-checklist.csv. Columns: Phase, Layer, Task, Owner, Evidence, Done.

What is an employee offboarding IT checklist?

An employee offboarding IT checklist is the IT half of a leaver process. HR handles the contract, final pay and the exit interview. IT handles three layers: the apps on the laptop, the account in each app, and the resources inside each app, such as Slack channels, Google groups, GitHub repos and shared drives.

Most checklists stop at the second layer. Suspending the Google Workspace or Microsoft Entra account blocks new sign-ins through single sign-on. It does not close accounts that have their own password, live sessions, API tokens or paid seats, and it does not move the channels, repos and files the person owned. A leaver who owned a shared drive or a billing account leaves that item without an owner unless someone moves it first.

The layer column in this template makes the gap visible. Every row names the layer it touches, so a team can see at a glance whether the resources inside each app got any attention at all. Offboarding without SCIM explains why the account layer alone leaves gaps.

What is in the employee offboarding checklist template (Excel)?

The template has 28 steps in four phases, with columns for Phase, Layer, Task, Owner, Evidence and Done.

Copy the table below, or download the CSV. In Google Sheets, choose File, Import, Upload. Make one copy per leaver and fill the Evidence column as you go.

Phase	Layer	Task	Owner	Evidence
Before the last day	All	Confirm the last day and the manager with HR	IT	HR record
Before the last day	Account	List every app the person has an account in, including apps they signed up for themselves	IT	App list
Before the last day	Account	Check the card statement and supplier invoices for apps bought outside IT	Finance	Statement lines
Before the last day	Resources	Name who inherits files, calendars and shared drives	Manager	Named owner
Before the last day	Resources	Find what the person owns: repos, channels, groups, shared drives, billing accounts, domains	IT	Owner list
Before the last day	Resources	Transfer ownership to the new owner	IT	New owner shown in app
Before the last day	Resources	Move automations, integrations and AI agents the person owns to a team owner	IT	New owner shown in app
Before the last day	Account	List admin roles in every app and who takes them over	IT	Role list
Before the last day	Account	Move subscriptions paid on the person's card to a company card	Finance	Invoice to company
Before the last day	Laptop	Arrange the laptop return; send a prepaid box to a remote leaver	IT	Tracking number
Last day	Account	Suspend the Google Workspace or Entra account and sign out every session	IT	Admin console status
Last day	Account	Reset MFA devices and revoke app passwords	IT	Admin console status
Last day	Account	Deactivate each SaaS account, starting with apps outside single sign-on	IT	User list per app
Last day	Resources	Revoke personal API tokens, OAuth grants and SSH keys	IT	Token list empty
Last day	Resources	Remove from shared vault collections and rotate shared passwords	IT	Vault log
Last day	Account	Change shared logins: registrar, bank, billing portal	IT	Change date
Last day	Resources	Remove from on-call rotations, approval chains and email aliases	IT	Rotation and alias lists
Last day	Account	Remove admin roles and privileged access	IT	Role list per app
Last day	Account	Close VPN and remote desktop access	IT	VPN user list
Last day	Account	Set a mailbox auto-reply that names a new contact	IT	Auto-reply text
Last day	Laptop	Lock the laptop remotely if it is not back	IT	MDM command log
After	Account	Check sign-in logs the next day for activity	IT	Log export
After	Account	Forward or archive the mailbox, set retention	IT	Retention setting
After	Laptop	Wipe and re-enrol the returned laptop	IT	MDM status
After	Account	Free or reassign paid seats	IT	Seat count
After	Account	Delete accounts after the retention period	IT	Deletion date
After	All	Seven days later, read each app back and confirm no access	IT	Read-back per app

What is the offboarding process in IT?

The offboarding process in IT runs in three phases around the last day, plus a faster order for a dismissal.

Before the last day, IT builds the list: every app, every admin role, everything the person owns. The card statement belongs in this step, because the identity provider only knows the apps someone connected to it. Each recurring charge is an app somebody uses.

On the last day, IT closes access. The order matters: suspend the identity account first so no new session starts, then close apps outside single sign-on, then revoke tokens. Tokens and OAuth grants act as the person and can outlive a suspended account. Shared logins have no account to disable, only a password to change.

After the last day, IT checks the sign-in logs, keeps the mailbox for the retention period, and deletes accounts only after that. Deleting on day one loses files nobody has claimed yet. A deactivated account can come back if HR got the date wrong; a deleted one usually cannot.

What are the employee offboarding best practices?

Run an involuntary leaver in a different order. When someone is dismissed, IT closes access at the moment the person is told, not at the end of the day. Start with what does the most damage: admin roles, shared logins and API tokens. Then suspend the identity account. Do the before-the-last-day steps afterwards. The CSV has this order as its last row.

Treat a read-back as the evidence. A ticket that says "done" proves a change was sent. A user list exported from the app proves the account is gone. An ISO 27001 or SOC 2 auditor asks who had access, and when it was removed; the Evidence column is the answer. NIST SP 800-53 control PS-4 asks for the same three things: disable access within a set time, revoke credentials, and retrieve company property (NIST via csf.tools, checked 4 November 2026).

Add AI tools to the app list. People sign up for AI tools with a work email, outside single sign-on. Revoke the API keys the person created and free the paid seats.

Keep one filled-in copy per leaver, with the date of each line.

Can you automate employee offboarding?

Automation means the HR system starts the leaver steps and software carries them out in each app. SCIM covers part of this: it lets an identity provider deactivate accounts in apps that support it. Many vendors sell SCIM only on top plans. Slack offers it on Business+ and Enterprise Grid (Slack help, checked 4 November 2026); Notion offers it on Enterprise only (Notion help, checked 4 November 2026). SCIM also stops at the account. It does not hand over channels or repos, and it does not touch the laptop.

The manual step in this checklist is the read-back: opening each app, finding the person and confirming the account is gone. Caspian does that step. It starts the leaver steps from the HR system, works through each app by API, SCIM or an auditable browser script, and reads each app back afterwards. A person approves every removal. Caspian costs €10 per active user per month, excluding VAT, with all of that person's laptops included. Start for free.

What does Caspian read, and with which rights?

Caspian reads metadata and settings, not content. It reads which apps exist, who has an account, which role that account has, and the state of each laptop. It does not read file contents, email bodies or chat messages. Connections are read-only by default; Caspian asks for write rights only for the steps you switch on, such as removing a leaver's account. Customer data is stored with AWS in the EU (Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress.

Simon Mestdagh, founder of Caspian, wrote this page. We make Caspian, one of the tools discussed here.

FAQ

Is there a free IT offboarding checklist template in Excel?

Yes. Download it-offboarding-checklist.csv. It opens in Excel and has the columns Phase, Layer, Task, Owner, Evidence and Done.

When should IT remove a leaver's access?

By the end of the last working day. For a dismissal, at the moment the person is told, starting with admin roles, shared logins and tokens.

Should IT delete a leaver's accounts on the last day?

No. IT deactivates on the last day, hands over what the person owned, and deletes after the retention period. Deleting first can lose files nobody has claimed.

What is the most missed step in IT offboarding?

Apps outside single sign-on, and the tokens and OAuth grants the person created. Suspending the Google Workspace or Entra account does not close them.

When is offboarding finished?

When IT reads each app back and sees the account deactivated or removed, and the Evidence column has an entry for every row.

← All resources