Onboarding and Offboarding: An IT Checklist for Every Hire and Every Exit

New hires and departures are where small-business IT quietly gets messy. Someone starts on Monday and spends the morning waiting for a login. Someone leaves, and months later their account is still active, still licensed, and still able to read the shared mailbox.

Neither problem takes clever technology to fix. It takes a checklist that gets used every time. Here is the one we would start with.

Before the first day

Good onboarding starts when the offer is accepted, not when the person walks in.

• Create the account early Use your standard naming format, and set a temporary password that must be changed at first sign-in.
• Assign the right license Match it to the role. Not everyone needs the most expensive plan.
• Add them to groups, not individual folders Give access by role (Sales, Accounting, Office) so permissions stay consistent and are easy to remove later.
• Prepare the device Updated, encrypted, with security software and the apps the role needs already installed.
• Order anything physical Phone, headset, monitor, door badge or key.

On day one

• Set up multi-factor authentication together Walk them through the authenticator app in person or on a call, so they are not locked out the first time they work from home.
• Share passwords the right way If the role needs shared logins, add them to your business password manager. Never send them by email or text.
• Explain how to get help Who to contact, how, and what to do if something looks suspicious.
• Cover the basics of security A short walkthrough on phishing, locking screens, and where files should be saved.

The first few weeks

Check back after a week or two. Do they have everything they need? Did anyone grant extra access "just for now" that should be removed? It is much easier to tidy up permissions while the details are fresh.

The day someone leaves

Offboarding matters more than onboarding, because the risk is higher. Whether the departure is friendly or not, the steps are the same, and timing is everything: ideally access ends at the moment employment does.

• Disable the account Block sign-in rather than deleting it straight away, so mail and files are preserved.
• Sign them out everywhere Revoke active sessions so phones and home computers lose access immediately.
• Remove their MFA methods and devices Including any authenticator registrations and app passwords.
• Change shared passwords they knew Wi-Fi, alarm codes, vendor portals, social media and anything in shared password vaults.
• Forward or delegate their email Give a manager access to the mailbox, or convert it to a shared mailbox, and set an auto-reply if useful.
• Transfer file ownership Move OneDrive or Google Drive files to the right person before the account is removed.
• Collect devices Laptops, phones, keys, badges and security keys. Wipe company data from personal phones if they used one for work.
• Remove them from outside services Banking portals, payroll, accounting software, domain registrar, and any app they signed up for with a work email.

After they are gone

• Reclaim the license Once mail and files are handled, free the license so you are not paying for an empty seat.
• Keep what you need to keep Check whether your industry or contracts require you to retain their mail and files, and for how long.
• Review the list Note anything you forgot, and add it to the checklist for next time.

Make it one shared checklist

The biggest improvement is simply having one written list that HR, the office manager and IT all work from. When a hire or exit is announced, someone starts the checklist and ticks every line. Nothing depends on memory, and nothing gets missed because it was a busy week.

Want a version of this checklist set up for your team? We are glad to build it with you.