1. Prepare and coordinate

Confirm the authorized cutoff time with HR, management, and the system owner.Determine whether the exit is planned, urgent, or part of an active investigation.Record required legal holds, evidence-preservation steps, or regulatory obligations before changing systems.Inventory assigned devices, physical badges, security keys, certificates, applications, shared vaults, vendor portals, and privileged roles.Transfer ownership of business email, files, calendars, automations, domains, repositories, and vendor relationships.

2. Contain access at cutoff

Disable or suspend the primary directory identity and block new authentication.Revoke active identity-provider and application sessions using provider-side controls.Clear local browser session material from connected Locke profiles with Strong Single Logout when risk warrants it.Revoke VPN, remote desktop, Wi-Fi, SSH, cloud console, and other infrastructure access.Isolate or lock managed endpoints when required by the incident or offboarding plan.

3. Remove applications and credentials

Remove group memberships, admin roles, delegated access, service-desk roles, and shared mailbox access.Deprovision managed SaaS applications and separately review apps without SSO or automated provisioning.Rotate shared passwords, API keys, access tokens, recovery codes, and secrets the employee could view.Remove the employee from shared password vaults, code repositories, cloud projects, and vendor accounts.Review email forwarding, delegated inboxes, OAuth grants, app passwords, and personal recovery methods.

4. Recover devices and information

Recover laptops, phones, tablets, security keys, access badges, removable media, and other company property.Confirm device check-in and apply the approved lock, wipe, reimage, or evidence-preservation workflow.Preserve business records and transfer access without copying personal data outside the approved process.Remove company certificates, MDM profiles, and device trust where applicable.

5. Verify and close

Confirm critical accounts are disabled and privileged roles have been removed.Review recent sign-ins and security logs for unexpected activity before and after cutoff.Document exceptions, systems awaiting manual removal, and the owner and deadline for each follow-up.Notify the authorized stakeholders that the offboarding checklist is complete.Retain the completed record according to company policy.

Completed by Date / time