Departing employees, especially those leaving on bad terms, are a security risk. A consistent process closes the gaps.

Before the last day

– Get notice from HR with the exit date and circumstances

– Plan the timing: for sensitive departures, access may need to end immediately

– Identify what they own: shared files, mailboxes, distribution lists, automations, and vendor accounts

– Arrange knowledge transfer to a colleague

On the last day

– Disable the account (don’t just delete it) and reset the password

– Revoke sessions and sign them out of all devices

– Remove MFA methods and registered devices

– Disable remote access: VPN, remote desktop, and other tools

– Remove from groups, shared mailboxes, and Teams

– Recover equipment: laptop, phone, tablet, badges, keys, tokens, and accessories

– Wipe or reassign devices after backing up needed data

Within days

– Forward or delegate email to the manager for a set period, and add an auto-reply

– Transfer ownership of OneDrive files, SharePoint sites, and shared documents

– Review third-party apps and vendor logins tied to the user

– Change shared passwords the person knew

– Remove license assignments to stop paying for unused seats

– Update phone systems, directories, and signatures

Within weeks

– Retain data as required by policy and law, then delete according to your schedule

– Review logs for unusual activity before departure

– Document completion for audit purposes

Personal devices

If staff used personal phones for work, remove company data and apps through your mobile management tool.

Law 25 note

Handle personal information on departing employees’ accounts carefully, and delete it when no longer needed.

Make it automatic

A standard checklist in your ticketing system and a clear link to HR processes prevent forgotten steps.

DBR Soft handles offboarding as part of its managed services. Contact us for more information.