Quick answer: An IT Support checklist for employee onboarding and offboarding should cover email/Microsoft 365, MFA, VPN, devices, software, data access, asset handover, licenses, file ownership transfer and ticket acceptance. If skipped, the business may lose data, keep paying for unused licenses, grant wrong access or leave old accounts active after employees leave.
What should an IT Support onboarding/offboarding checklist include?
It should include six groups: accounts, devices, software, data permissions, security and acceptance evidence. For new employees, the goal is to make them productive on day one. For leavers, the goal is to revoke access on time, retain company data and keep the handover smooth.
This is a core part of IT Support service and IT Helpdesk service, especially for companies using Microsoft 365, servers, NAS, accounting software, CRM or ERP.
Why onboarding and offboarding are critical IT tasks
Many companies see new hires and leavers as HR-only events. In practice, IT owns accounts, computers, email, data, licenses, security and access rights. Without a process, new employees wait for email, devices and app access; leavers may keep access or leave business data unmanaged.
The biggest risk is not one technical fault. It is the lack of traceability. No one knows which accounts were created, which access was granted, which device is assigned, which license is still active and who approved completion. Every onboarding/offboarding request should therefore go through a ticket or standard form.
IT checklist for new employees
| Timing | IT task | Condition for good execution |
|---|---|---|
| Before start date | Create email/Microsoft 365/Google Workspace account, groups, MFA, computer and required software | HR sends details 1-3 days early; manager approves access |
| Day one | Hand over device, email login, Wi-Fi/VPN, printer, internal apps and email signature | Completion evidence or ticket closure required |
| First week | Check apps, shared files, printer, meetings and security setup | Record issues and standardize user profile |
| After probation | Review access, licenses, device ownership, chat groups and software needs | Remove excessive access and optimize licenses |
IT checklist when employees leave
| Timing | IT task | Condition for good execution |
|---|---|---|
| Before leaving date | Confirm lock date, handover owner, data to retain and device return | HR and direct manager approve |
| Leaving date | Disable login, revoke MFA, rotate shared passwords, recover device and accessories | Prioritize email, VPN and internal systems |
| After leaving | Forward email, retain data, transfer file ownership, review licenses and groups | Do not delete data before approval |
| Acceptance | Check devices, accounts, data, access and completed ticket | Keep a handover record or report |
Accounts that should be checked
The list is larger than email. It may include Microsoft 365 or Google Workspace, accounting software, CRM, ERP, time attendance, cameras, VPN, Wi-Fi, NAS/file server, POS, ticketing system, digital signature and vendor portals. Each account group needs an owner and a clear grant/revoke rule.
Shared accounts should be minimized. If legacy shared accounts still exist, passwords must be rotated when a person with access leaves. Personal accounts should be disabled and data transferred according to company policy instead of being deleted too quickly.
Devices and licenses: more than laptop return
Device handover should record asset code, serial, configuration, condition, accessories, monitor, mouse, keyboard, adapter, external drive, token and company phone if any. If the business pays software by user, the license should be recovered to avoid monthly waste.
This connects directly to IT asset management. A good checklist lets accounting, HR and IT use the same view: who holds which device, what condition it is in, which license is assigned and whether it should be reused for the replacement employee.
Common risks without a process
| Risk | Impact | Control |
|---|---|---|
| Old account still active | Data leakage, unauthorized access, poor auditability | Disable SSO/email/VPN/apps on leaving date |
| Licenses not recovered | Ongoing Microsoft 365 or business-app cost | Review licenses in monthly report |
| Business data stored locally | Lost files and poor handover | Standardize OneDrive/SharePoint/file server |
| No device inventory | Lost laptops, accessories or IT assets | Track assets by device code and user |
| Overly broad access | New user sees unnecessary data | Grant by role and manager approval |
How to use tickets and forms
Onboarding and offboarding should be separate Helpdesk ticket types. The form does not need to be long, but it must capture name, department, role, effective date, manager approval, devices, software, access groups and special notes. For offboarding, it should also include data owner and account lock timing.
| Field | Recommended value | Reason |
|---|---|---|
| Requester | HR or direct manager | Avoid unapproved self-requested access |
| Ticket type | Onboarding, offboarding, role change, device change | Improves reporting and traceability |
| Required details | Name, department, role, effective date, required access | Reduces back-and-forth |
| Approver | Department manager, HR, asset owner if needed | Prevents wrong access |
| Completion proof | Handover photos, account list, lock/open status | Supports service acceptance |
Suggested process for 20-100 user businesses
For small and mid-sized businesses, the process should be compact but controlled. HR creates the ticket before start/leaving date. The direct manager approves access. IT prepares accounts, devices and licenses. On the effective date, IT enables or disables access by checklist. Finally, the ticket stores evidence: handover photos, account state, license list and approver confirmation.
Multi-branch companies should add branch confirmation: who receives the device, who recovers the device, where it is shipped and whether onsite work is required. Chat-only handling makes this information easy to lose.
Connection with SLA and monthly reporting
New-hire and leaver requests need their own SLA. For example, if an onboarding ticket is sent with full details two business days early, IT can commit to preparing accounts and devices before the start date. An urgent offboarding ticket may require disabling access within 15-30 minutes after HR confirmation. If HR sends details late or approvals are missing, the waiting time should not count as an IT SLA miss.
The monthly IT Support report should include onboarding/offboarding count, delayed tickets due to missing information, recovered licenses, unreturned devices and remaining access. This helps HR, asset accounting and management.
Do not forget internal role changes
IT checklists are not only for new hires and leavers. When an employee changes department, becomes a manager, moves branch or shifts from sales to finance/operations, access rights must also be reviewed. This case is often missed because the account remains active, the laptop is still in use and there is no clear leaving date.
The safest rule is to grant access by current role, not by accumulated work history. If someone used to work in finance and then moves to another role, old finance data access should be removed unless there is a valid business need. A role-change ticket should be approved by the old manager, new manager and HR so the employee does not lose required new access while retaining unnecessary old access.
This also protects managers. If a data leak or unauthorized change happens months later, the company can show who approved the access, when it was changed and which rights were removed. That evidence matters for audits, compliance reviews and internal investigations.
When to outsource IT Support for this process
If the business has limited internal IT, many users, many applications or frequent hiring/leaving, outsourced IT Support can standardize the process without building a large internal IT team. The provider can coordinate with HR, department managers and asset accounting to create forms, tickets, checklists, reports and access rules.
The key is to require more than “installing laptops.” The IT provider should manage the user lifecycle: role-based access, timely revocation, evidence, license reporting and access-risk alerts.
FAQ
Should email be disabled immediately when an employee leaves?
Login should be disabled according to HR confirmation, while email and file data should be retained according to company policy. Forwarding or delegated access can be granted when needed.
How early should new-hire IT requests be submitted?
Ideally 1-3 business days before the start date. Special hardware, licenses or complex application access may need more time.
Should MFA be checked during offboarding?
Yes. Sessions, MFA devices, authenticator apps, VPN and related tokens should be revoked to prevent old access.
Read next in the IT Support and Helpdesk cluster
Need to standardize IT onboarding and offboarding?
IT Systems can design forms, tickets, checklists, access rules, device handover and monthly reports so new hires start faster and leavers are handled securely.
