Deactivate the employee's Active Directory account and any federated SSO credentials on the scheduled date. Move the account to the disabled users OU and set it for automated deletion per retention policy.

Disable the employee's access to all cloud services including Google Workspace, Microsoft 365, Salesforce, Slack, Jira, and any other SaaS platforms. Transfer ownership of shared resources before deactivation.

Delete the employee's VPN profile, revoke any remote desktop access, and remove their device certificates. Ensure all remote access tokens and saved sessions are invalidated immediately.

Remove the employee's registered MFA devices, hardware tokens, and authenticator app enrollments from the identity management system. Recover any physical security keys issued to the employee.

Remove the employee's access to all databases, data warehouses, and analytics platforms. Pay special attention to any elevated privileges or admin access that could pose a security risk if left active.

Deactivate the employee's email account and set up an auto-reply directing senders to an appropriate alternate contact. Configure email forwarding to the employee's manager for a defined transition period.

Retrieve the employee's company laptop, verify the asset tag matches inventory records, inspect for physical damage, and log the return in the IT asset management system with condition notes.

Collect monitors, docking stations, keyboards, mice, webcams, headsets, and any other peripherals assigned to the employee. Cross-reference against the equipment issuance record to ensure nothing is missing.

Collect company phones, tablets, and SIM cards. Perform a remote wipe if the device was used for corporate email or data access, and verify the wipe completed successfully before reassigning the device.

Recover USB drives, external hard drives, hardware security keys, and any portable storage media issued to the employee. Scan for and securely erase any company data stored on these devices.

Log all returned hardware in the IT asset management system, updating the status of each item to available, needs repair, or retire. Reconcile the employee's complete equipment record and close any outstanding items.

Create a complete backup of the employee's email account including all folders, sent items, drafts, and calendar entries. Store the backup according to the company's data retention policy and legal hold requirements.

Identify all files, folders, and documents owned by the employee in cloud storage platforms. Transfer ownership to the designated successor or manager, and archive any files that are no longer actively needed.

Perform a certified data wipe on all returned devices, removing both company and personal data. Use approved data destruction methods that comply with the company's information security policy.

Audit all shared drives, SharePoint sites, and collaboration spaces where the employee had owner or admin access. Transfer those permissions to appropriate team members to maintain continuity of access.

Check with legal to determine if any of the employee's data is subject to litigation hold or regulatory retention requirements. Preserve all relevant data in accordance with legal counsel's instructions.

Examine the employee's recent system access logs, file download history, email activity, and login patterns for any anomalous behavior such as mass data downloads, unauthorized access, or after-hours activity.

Audit Active Directory, email distribution lists, Slack channels, Teams groups, and any other group memberships to ensure the employee has been removed from all internal communication and access groups.

Contact or check all external vendor portals, partner systems, and third-party platforms where the employee had authorized access on behalf of the company, and ensure those accounts are deactivated.

Execute a comprehensive access review across all systems using the identity governance platform to confirm that no active access remains for the departed employee. Document the audit results for compliance records.

Update the offboarding ticket with a complete record of all actions taken, devices recovered, accounts disabled, and any outstanding items. Close the ticket and notify HR that IT offboarding is complete.