What is offboarding?

What is offboarding?

Offboarding happens when an employee, contractor or student leaves, and in part when someone changes roles. IT works from an off-boarding checklist (sometimes called an end-user termination checklist) so every account, device and data store is handled in the right order and nothing is left open. Speed matters. An account that stays active after its owner leaves can be used by that person, or by anyone who later gets hold of the credentials, and nobody is watching it.

A typical offboarding checklist

1. Confirm authority and timing. Get the HR notice or manager approval and the effective date and time. For an involuntary departure, coordinate with HR and security and act at the agreed moment.
2. Disable the account. Disable, don't delete, the directory account first. Then revoke active sessions and refresh tokens in cloud apps, remove registered MFA methods and block VPN and remote access.
3. Cover what single sign-on misses. Remove access to apps with their own logins, local accounts and shared accounts. Change shared passwords and rotate any secrets the user knew, such as service account or Wi-Fi passwords.
4. Recover equipment. Collect laptops, phones, badges, keys, hardware tokens and removable media, and update the asset records. If a device cannot be recovered, use mobile device management (MDM) to lock or wipe it according to policy.
5. Transfer data. Give the manager access to the mailbox and files, transfer ownership of cloud folders and review shared links that could outlive the account.
6. Apply retention rules. Keep mail and files for the required retention period and never delete data under a legal hold. Delete the account only after the retention period and approvals allow it.
7. Document. Record each system touched, what changed, who approved it and when.

Why disable instead of delete?

Deleting an account right away can destroy a mailbox and files the business still needs, break ownership of shared content and remove the audit trail. It also cannot be undone by recreating the account. In Windows and Active Directory, permissions are tied to a security identifier (SID), and a new account with the same name gets a new SID, so the old access does not come back. Disabling blocks sign-in immediately while keeping everything recoverable. Deletion comes later.

Common gaps

• Shared mailboxes, generic logins and local admin passwords the user knew
• Personal phones still syncing company email; an MDM selective wipe removes company data and leaves personal data alone
• Remembered browsers and authenticator apps that keep sessions alive after a password change
• Devices never returned, which leaves the asset record wrong and the data unaccounted for
• Internal transfers that add access for the new role but never remove the old role's access

Offboarding vs onboarding

Onboarding grants access by role when someone arrives. Offboarding removes it when they leave. If onboarding used role-based groups, offboarding is faster and more complete, because removing the groups removes the access. If access was granted ad hoc, someone has to hunt for it.

Offboarding on the CompTIA A+ exam

Core 2 (220-1202) objective 4.1 covers documentation such as onboarding and off-boarding checklists, and objective 2.7 covers workstation hardening, where tight account management, including removing access that is no longer needed, is a core practice. If a scenario says a former employee still reached company email, think account not disabled or sessions not revoked. If it asks what to do first when someone is terminated, think disable the account at the time of departure. If it asks why not delete the account immediately, think data retention, legal holds and transfer of ownership.