Onboarding gets attention because a new person can’t work until it’s done. Offboarding gets skipped because nothing visibly breaks when it’s late.
But an account that stays active after someone leaves is one of the most common ways businesses lose control of their information. It’s not usually malicious. It’s a forgotten login on a shared vendor portal, or a phone that still syncs company email.
Here is the checklist we use, simplified for a business doing it themselves.
On the last day (or before the conversation, if it’s sensitive)
- Block sign-in to their Microsoft 365 or Google Workspace account
- Reset the password and sign out all active sessions
- Remove or wipe company data from their phone
- Disable VPN and remote access
- Collect laptops, keys, badges, and any company hardware
Within the first week
- Convert their mailbox to a shared mailbox, or forward mail to their manager
- Transfer ownership of files in OneDrive or Google Drive
- Remove them from shared vaults in the password manager, and change any shared passwords they knew
- Remove access to line-of-business software, banking portals, and vendor accounts
- Update phone system, voicemail, and website contact pages
Within the first month
- Remove or reassign their software licenses so you stop paying for them
- Archive the account per your retention policy
- Wipe and reimage their computer before giving it to someone else
Make it repeatable
The real fix is to stop relying on memory. A written checklist helps. Automation is better: when HR marks someone as departed, the steps above happen the same way, every time, and you get a record that they did.
How we help: Automated onboarding and offboarding are part of the Covaleon standard. Every managed client gets a defined process, and we handle it end to end.