IT Offboarding Checklist for Small Teams: Before, On and After the Last Day

This IT offboarding checklist is for small teams that run on Google Workspace or Microsoft 365, a spreadsheet, and good intentions.

Most guides on this topic start with "first, disable the user in Okta". Great advice, if you have Okta. Most companies with 20 to 250 people have one admin console, a shared asset sheet, and an HR email that says today is Dave's last day.

You don't need an enterprise identity platform to offboard well. You need the right order, the tools you already pay for, a clear asset record, and an IT offboarding checklist built for small teams.

The 30-Minute IT Offboarding Checklist You Can Actually Finish

Here is the full IT offboarding checklist in the order we run it for small teams. Each row names the exact place you do the step, when to do it, and roughly how long it takes, so nobody has to guess or ask twice.

#	Step	Where you do it	When	Time
1	Confirm the last day and exit type with HR	Email or HR system	As soon as you know	2 min
2	List their accounts, apps, and devices	Admin console, card statement, IT inventory	Before the last day	8 min
3	Move ownership of shared admin accounts	Registrar, MDM, vendor portals	Before the last day	4 min
4	Suspend or block sign-in, then revoke sessions	Google Admin or Entra admin center	Last day	3 min
5	Remove app passwords, app access, and MFA	Same admin console	Last day	2 min
6	Close non-SSO apps, rotate shared passwords	Each app and your password manager	Last day	5 min
7	Hand over mail and files	Mail and file admin	Last day	3 min
8	Collect devices and clear Activation Lock	Exit meeting and MDM	Last day	At the meeting
9	Reclaim licenses and update the IT inventory	Billing pages and asset records	Day 1 to 7	3 min
10	Check sign-in logs one more time	Admin console	Day 7	2 min

Steps 2 and 3 are the ones small teams skip, and they cause most of the trouble later. If time is short, never skip those two.

1. Before the Last Day: Your Exit List Is Hiding in Four Places

Small teams rarely lack data about a leaver. It is just spread out across tools that don’t talk to each other. Every good IT offboarding checklist starts with an exit list built a few days early, not at 4:45 pm on Friday. Once the account is suspended, some of this data gets much harder to reach.

Four Places Nobody Checks Together

• The admin console user page. It shows groups, licenses, and admin roles. Note any shared drives or groups they own, because those can break when the account goes.
• The company card or expense report. Every charge with their name is an app to close or move. Look back at least three months, since quarterly and annual plans hide in older statements.
• Your IT inventory. It should say which laptop, phone, and accessories they hold, with serial numbers, not just MacBook. If it doesn’t, that is a finding too.
• A 10-minute chat with their manager. Managers know the side tools and shared logins IT never saw. Ask one simple question. What would break next week if this person disappeared today?

Put all four into one list. That list becomes your offboarding ticket.

If onboarding recorded what each person received, this list takes 10 minutes. If it didn’t, offboarding is where you pay for it, one Slack message at a time.

Every App That Got a “Sign in With Google” Click

Your admin console can show which third-party apps the person allowed to use their work account. In Google Workspace, look in the user’s security settings. In Microsoft 365, check the apps they consented to in the Entra admin center. Removing access here is not the same as closing their account inside each app. Treat this list as the apps you will visit on the last day.

One more trick. With HR approval, search their mailbox for “welcome to,” “your invoice,” and “trial” before you suspend the account. Sign-up emails reveal the apps that never touched single sign-on, and trial emails catch the ones about to turn into paid plans.

2. Last Day: Changing the Password Is Not Offboarding

Changing the password feels like locking the door. It isn't. Open sessions keep working until they expire. This part of the IT offboarding checklist is where order matters most.

Timing depends on the exit. For a resignation, cut access at the end of the last day. For a termination, cut it during the meeting, not after.

Google Workspace: Suspend, Sign Out, Then Revoke

1. Suspend the user. Sign-in stops, browser sessions reset, and the data stays in place.
2. Sign them out of desktop apps too. Suspension doesn’t log them out of Gmail or Drive for desktop, so sign the user out from their devices in the Admin console.
3. Remove app passwords and third-party app access from the user’s security settings.
4. Remove them from groups, especially groups that receive customer email.
5. Then route new mail to a teammate, so customers aren’t writing to an empty inbox.

Then route new mail to a teammate, so customers aren't writing to an empty inbox.

Microsoft 365: Blocking Sign-In Is Only Step One

1. Block sign-in in the Microsoft 365 admin center.
2. Revoke sessions in the Entra admin center. This kills refresh tokens, but short-lived access tokens can work for up to an hour, so do it early.
3. Remove their MFA methods and recovery phone number.
4. Check their mailbox for forwarding rules they created to a personal address.

Running a hybrid setup with on-premises Active Directory? Disable the account there too. Otherwise, the next sync can switch the cloud account back on, and nobody will notice until somebody does.

3. The Apps Your Admin Console Can't Close

“Sign in with Google” is a login, not an offboarding plan. Suspending the account stops new sign-ins, but apps with their own sessions may still show the person as active. Slack, Zoom, Notion, and that design tool on the company card each need a visit.

Your IT offboarding checklist should treat each app as a three-part job.

• Deactivate the user
• Move ownership of their files or workspaces
• Cancel or reassign the seat.

Then rotate every shared password they knew, including office Wi-Fi, social logins, and door codes. A password manager makes this a 5-minute job instead of an archaeology project.

The small-team trap. What if the leaver is your IT person? In a company of 40, they often own the domain registrar, Apple Business Manager, the MDM, and the only break-glass admin login. Move each to a second owner before the farewell lunch. Losing your own domain is a very quiet way to start a very loud week.

Check where the MFA codes live, too. Shared logins often send codes to the leaver’s personal phone. Move them to your password manager first, or your next reset becomes a support ticket with a stranger.

Want to find these apps faster? Try AssetLoom's free Shadow IT Scanner.

4. Mailbox and License Cleanup: Stop Paying for Ghosts, Keep Their Data

In most small companies, suspended still means paid. That is how 30 people end up with 36 licenses.

In Google Workspace, a suspended user costs the same as an active one on Flexible and Annual plans. You have two clean options. Transfer their Drive files to a teammate, then delete the account. Or if you must keep the data for legal reasons, switch them to an Archived User license. Don’t delete first. A deleted user can be restored for only 20 days, and only if a free license is available. So keep the seat until the transfer is done. One more catch. On an Annual Plan, deleting a user won’t lower the bill until renewal.

In Microsoft 365, convert the mailbox to a shared mailbox. Under 50 GB, you can then remove the license. Two gotchas catch people. The mailbox needs a license at the moment you convert it. And you must not delete the user account afterward, because the shared mailbox depends on it.

Finally, check the apps billed outside your admin console. Once a month, compare the seat count on each invoice with your real headcount. This is the step most IT offboarding checklists forget to put on the calendar.

5. Devices: Get the iCloud Sign-Out Before the Farewell Cake

For the return process itself, see our guide to employee equipment tracking. This part of the IT offboarding checklist covers the traps a return box doesn't solve.

No MDM? Use the exit meeting. Ask the person to sign out of iCloud and turn off Find My on the company Mac or iPhone while you watch. If the device was in Apple Business Manager before the lock went on, you can still clear it there later. If it wasn’t, getting it back is slow and painful. Wipe first, ask later, and you now own a very expensive paperweight.

Have Intune, Jamf, or Apple Business Manager? Get the Activation Lock bypass code ready before you wipe. After a wipe, the device asks for the old Apple account or that code. Apple Business Manager can also clear it from the portal.

On Windows, make sure the BitLocker recovery key is saved in your admin console, not on a sticky note in the leaver's drawer.

Last, update your IT inventory management records the same day each device comes back. A laptop sitting in a drawer while the sheet says "assigned to Dave" is a laptop nobody can find for the next hire.

Why Offboarding Needs an Asset Record, Not a Spreadsheet

Spreadsheets look fine until someone leaves. Offboarding is when you need a fast, correct answer to "what does this person have?" Watch for these signs.

• You offboard more than two people a month.
• Your team works across offices or from home.
• Someone asks in chat "Who has the spare MacBook?" and gets three different answers.
• A customer security review asks for offboarding evidence, and you have strikethrough rows.

Picture the same exit twice. With a spreadsheet, you check three tabs and still miss the second charger. With assignment records, you open one profile and check each item back in as it returns.

At that point, IT inventory tracking in a sheet costs more time than it saves. This is where ITAM, or IT asset management, earns its place, and where AssetLoom fits. Every asset has a live status, and every checkout records who holds it and when it’s due back. That’s the answer you need before someone’s last day.

Every asset has a live status, and every checkout records who holds it and when it’s due back.

AssetLoom doesn't suspend accounts or wipe devices. Your admin console and MDM still do that. What it does is keep one clear record of who holds what, so the hardware side of your IT offboarding checklist closes properly every time.

• See every asset assigned to a person, ready for the exit list.
• Check devices back in by scanning QR or barcode labels with the AssetLoom mobile app.
• Check returns against asset loans and asset history to see who holds what and who had it before.
• Send a custody verification request a few days before the last day, while their work email still works. The leaver confirms what they still hold and its condition.
• Sync device data from Microsoft Intune and Jamf Pro.

The free plan covers teams managing under 250 assets, so free IT inventory management is a real option and not a trial in disguise. For teams comparing inventory management software for IT, that makes AssetLoom an easy first test.

Conclusion: Small Team, Same Standards

Small teams don’t need an enterprise identity stack to offboard well. They need the right order, the admin console they already have, and an asset record they can trust.

Most offboarding mistakes don’t come from bad intentions. They come from a list that lives in someone’s head, a spreadsheet nobody updated, and a Friday afternoon with no time to check.

AssetLoom fixes the record side of that problem. It shows what each person holds, sends custody verification requests before the last day, and keeps asset history so you know who had each device and when it came back. 

Build the exit list early, cut access in the right order, and stop paying for ghosts. Then run this IT offboarding checklist the same way every time.

Questions Small IT Teams Ask About Offboarding

1. How long does IT offboarding take for a small business?

With a ready exit list, expect about 30 minutes of hands-on work spread over the last week. Most of that time goes into finding things, not clicking buttons. Without a list, the same job can take hours of digging through emails, invoices, and chat history. The difference is rarely the tools. It is whether someone wrote down what the person had before they left.

2. Should I suspend or delete a Google Workspace user?

Suspend first, then delete. Suspension blocks sign-in right away and keeps the data in place, so you have time to transfer Drive files and mail to a teammate. Once the transfer is done, delete the account to free the license, since suspended users still cost one. If you need to keep the data for legal or contract reasons, switch to an Archived User license instead.

3. Do I need SSO to offboard someone securely?

No. SSO speeds things up, but a careful IT offboarding checklist works without it. You just close more apps by hand, which is why the exit list matters.

4. What offboarding records should a small business keep?

Keep a simple log alongside your IT offboarding checklist with the date, step, owner, and proof, such as a screenshot. Teams working toward ISO 27001 can map it to control A.5.11 for returning assets and A.5.18 for removing access rights.

5. What should we do with a former employee’s email address?

Keep it working for a while, but not forever. Set an auto-reply that points customers to a teammate, and route new mail to that person. Pick a fixed window, such as 30 to 90 days, then close it.