IT Onboarding and Offboarding: The Checklist Every Growing Business Needs

Hiring someone is exciting. Losing someone is stressful. In both cases, the part that quietly determines whether the transition goes smoothly — or turns into a month of small fires — is the technology handoff. New hires who spend their first three days waiting on a login lose momentum they never fully get back. Departing employees who keep an active email account, a VPN certificate, or admin rights on a payment system leave a door open that nobody is watching.

We’ve seen both sides of this at businesses of every size, and the pattern is remarkably consistent: companies write a great IT onboarding and offboarding process in their heads, then execute it from memory, one person at a time, differently every time. This guide turns that mental process into a repeatable checklist you can hand to whoever is running it this month — an office manager, an operations lead, or an outside IT partner — and get the same result every time.

Why IT Onboarding and Offboarding Deserves a Real Process

Most growing businesses treat onboarding as an HR task with a technology footnote. That framing is backwards. HR paperwork is largely the same for every hire; the technology side is where the variation, the cost, and the risk live.

Three things go wrong when there’s no documented process:

• Slow starts. A new hire’s first week is the cheapest time to build habits and the most expensive time to waste. Every hour spent waiting on an account is an hour of paid time producing nothing.
• Access sprawl. Accounts get created ad hoc, permissions get granted “temporarily,” and nobody ever removes them. Over a few years, half your team ends up with access they no longer need.
• Orphaned accounts. When someone leaves, the obvious accounts get shut off — email, Slack, the CRM. The forgotten ones are the dangerous ones: the domain registrar, the ad platform, the shared payment portal, the marketing tool nobody’s logged into since last year.

None of this is exotic. It’s ordinary administrative drift, and the fix is equally ordinary: write it down once, then run the same play every time.

The security risk in most small businesses isn’t a sophisticated attacker. It’s an account that should have been closed eighteen months ago and still works.

Start With an Access Inventory

You cannot onboard or offboard well if you don’t know what exists. Before you build a checklist, spend an afternoon building an inventory of every system your business pays for or depends on. For each one, record four things:

1. What it is and what it’s used for.
2. Who owns it — the person accountable for the account, not just whoever uses it most.
3. How access is granted — is it tied to your company email directory, or does it have its own separate username and password?
4. Who currently has access, and at what permission level.

That last distinction — directory-linked versus standalone — is the single most useful thing on the list. Systems tied to your identity provider (Microsoft 365, Google Workspace, or similar) can be shut off centrally in one action. Standalone accounts must be handled individually, and those are the ones that get missed. When you build your inventory, flag every standalone account. That flagged list becomes the highest-value part of your offboarding checklist.

Typical categories worth walking through:

• Email, calendar, file storage, and chat
• Phone system, business SMS, and voicemail routing
• CRM, help desk, and project management
• Accounting, payroll, banking, and expense tools
• Website admin, hosting, DNS, and domain registrar
• Advertising accounts, analytics, and social media profiles
• VPN, remote access, Wi-Fi credentials, and any on-premise servers
• Physical items: laptops, monitors, phones, keycards, keys

The IT Onboarding Checklist

Good onboarding starts before day one. The goal is simple: when the new hire sits down, everything works, and someone shows them how to use it.

Before Day One

• Confirm the role, not just the person. Define access by job function — “field technician,” “account manager,” “bookkeeper” — rather than deciding fresh for each hire. Role-based access is faster to grant, easier to audit, and far easier to revoke.
• Create the identity first. Set up the company email account and directory identity, then use it to provision everything downstream. Resist the temptation to create standalone logins when a directory-linked option exists.
• Enable multi-factor authentication at creation. It is dramatically easier to make MFA a condition of the account existing than to roll it out to a reluctant team later.
• Provision hardware and image it. Laptop or desktop, monitor, headset, phone. Install the standard software set, endpoint protection, and any device-management agent before it reaches the employee’s desk.
• Add them to the right groups. Distribution lists, shared drives, chat channels, phone ring groups, and on-call rotations.
• Set up a password manager seat. If your team shares any credentials at all — and almost every team does — a managed password vault is the difference between controlled sharing and a spreadsheet nobody admits to.

Day One

• Walk through login, MFA enrollment, and password manager setup together. Ten guided minutes prevents ten support tickets.
• Cover the security basics in plain language: how to spot a phishing email, what to do if they think they clicked something, and who to call. Make it explicit that reporting a mistake quickly is always the right move and will never get them in trouble.
• Show them where files live and how naming and folder conventions work. File chaos compounds; it’s cheapest to prevent on day one.
• Confirm phone and voicemail work, and that they know how calls route to them.
• Have them acknowledge your acceptable use and data handling policies — and make sure those documents actually exist and are readable.

First 30 Days

• Check in on access gaps. New hires routinely work around missing permissions instead of asking, which creates shadow processes you’ll discover much later.
• Audit what you actually granted versus what the role template says. Drift starts immediately.
• Record the hardware assignment — serial number, assignment date, and who has it — in whatever system you use to track assets.

The IT Offboarding Checklist

Offboarding is where most of the risk sits, and where the pressure to move fast is highest. It also has a wrinkle onboarding doesn’t: you need to remove access and preserve the work product, and those two goals conflict if you do them in the wrong order.

The correct sequence is: preserve first, then revoke, then reclaim.

Preserve

• Transfer file ownership before disabling anything. Files owned by a deleted account can become unreachable, or vanish entirely depending on the platform’s retention rules. Reassign ownership of documents, shared drives, and folders to a manager or a shared team location.
• Capture the mailbox. Convert it to a shared or archived mailbox rather than deleting it, and set the retention period deliberately.
• Reassign records. CRM contacts, open deals, support tickets, and project tasks need a new owner or they go quiet. This is a business continuity issue, not an IT one — an unassigned pipeline is lost revenue.
• Document what only they knew. Vendor contacts, recurring processes, scheduled reports, undocumented workarounds. If there’s notice, use it.

Revoke

• Disable the directory identity. One action that closes every connected system at once — which is exactly why you built the inventory.
• Kill active sessions and tokens. Disabling a password does not always end a session that’s already signed in on a phone or a browser. Force a sign-out everywhere.
• Work the standalone list. Every account you flagged as not directory-linked, one by one. Change shared passwords the person knew, and update the password manager so the rest of the team gets the new credentials.
• Remove admin and billing roles. Ad accounts, hosting, DNS, the domain registrar, payment processors. Administrative access is often personal rather than role-based on these platforms and survives everything else.
• Handle the phone. Remove the extension, reroute the direct line, update ring groups and after-hours routing, and forward or reassign the number so customers calling their old line reach a person.
• Revoke physical access. Keycards, keys, alarm codes, and any building or facility system.

Reclaim and Verify

• Collect hardware and check it against your asset record. Wipe and re-image before reassignment.
• Set an email auto-reply or forward that tells senders who to contact now.
• Remove them from your website, directory listings, and marketing materials.
• Verify. A week later, walk the inventory again and confirm each item is closed. Verification is the step that gets skipped, and it’s the one that catches the miss.

Onboarding vs. Offboarding: Different Priorities, Same Inventory

Dimension	Onboarding	Offboarding
Primary goal	Productive fast	Closed completely
Biggest failure	Wasted first week	Lingering access
Time pressure	Known in advance	Often same-day
Sequence	Identity first, then apps	Preserve, revoke, reclaim
Verification	30-day access check	Post-departure audit

Plan for the Unplanned Departure

Every checklist above assumes two weeks’ notice. Sometimes you get two hours. Build a short-form version of your offboarding process — the five or six actions that must happen immediately, in order — and make sure at least two people know how to run it and have the credentials to do so.

At minimum, that emergency sequence should cover: disable the directory identity, force sign-out of all sessions, remove admin rights on financial and advertising platforms, reroute the phone line, and revoke physical access. Everything else can wait a day. These five cannot.

The other half of planning for the unplanned is making sure the process doesn’t live with one person. If your office manager is the only one who can disable accounts, you have a continuity problem that will surface at the worst possible moment. Document the process, store the credentials in a shared vault with proper access controls, and name a backup.

A process only one person can run isn’t a process. It’s a dependency.

Automate the Parts That Repeat

Once the checklist is stable, look for what can be automated. Most modern business platforms support some form of automated provisioning, group-based access, and scheduled access reviews. The realistic goal for a small or mid-sized business isn’t a fully automated pipeline — it’s reducing a forty-item manual checklist to a handful of decisions plus a few clicks.

Practical places to start:

• Role-based groups. Adding someone to one group grants a dozen permissions. Removing them from it revokes all twelve.
• Device management. Push standard software, security settings, and updates centrally, and retain the ability to remotely wipe a lost or unreturned device.
• Quarterly access reviews. A recurring calendar item where a manager confirms who should still have access to what. This catches drift before it becomes a finding.
• A shared runbook. The checklist itself, in a document your team can actually find, updated whenever you add a new system.

This connects directly to the broader hygiene we cover in our guide to small business cybersecurity — access management is the unglamorous foundation that makes everything else you do on security actually work. If you’d rather not own the operational side of it at all, that’s precisely the kind of recurring work a managed IT services relationship is built to absorb.

Where to Start This Week

Don’t try to build the perfect system. Build a usable one, then improve it on the next hire and the next departure.

1. Build the inventory. One afternoon, one spreadsheet, every system your business uses. Flag the standalone accounts.
2. Write two checklists from the templates above, adjusted to what’s actually in your inventory.
3. Run an audit of current access. You will almost certainly find at least one account belonging to someone who left. Close it.
4. Name an owner and a backup for the process, and store credentials somewhere both can reach.
5. Test the emergency sequence on paper. If you had two hours’ notice tomorrow, could you execute it?

A solid IT onboarding and offboarding process isn’t a compliance exercise. It’s how you make sure new people get productive quickly, departing people leave cleanly, and your business isn’t quietly accumulating open doors. It costs one afternoon to set up and saves you from the one incident you’d rather not explain to a client.

Let’s Build Your Process Together

If your access inventory lives in someone’s memory, or you’re not confident every former employee is fully offboarded, that’s worth a conversation. Our team helps Orange County businesses build practical I.T. and communications processes that hold up as the team grows — identity management, device provisioning, phone systems, and the day-to-day support that keeps it all running. Reach out at frozencrow.com for a free, no-obligation consultation. Our team, your goals.