Employee IT Offboarding Checklist for Small Businesses: Revoke Access Without Losing Data

The Short Answer: Preserve, Transfer, Then Revoke

An employee IT offboarding checklist for a small business should do four things in a fixed order: confirm the authorized departure and name an owner, inventory every account, secret and dependency the person touched, preserve and transfer what the business needs to keep, and only then revoke sign-in, deactivate seats and rotate shared credentials. Revoking first feels decisive, but on several mainstream platforms it is the step that destroys data or breaks automations. Deleting a Google Workspace user also deletes the secondary calendars they owned, and Microsoft 365 email forwarding stops working if you delete the account that anchors it.

The second principle is that sign-in, sessions, tokens and seats are different controls. Resetting a password does not end an existing session on every platform, suspending a Google account does not sign the person out of desktop apps such as Drive for desktop, and a Slack deactivation revokes that member's API tokens while bot users, slash commands and incoming webhooks keep running. A complete checklist names each control separately and records when it was applied.

This guide is for owners, office managers and the person who ends up being IT at a company of roughly five to fifty people. It combines vendor documentation checked on November 8, 2026 from Microsoft, Google, Slack, GitHub, 1Password, HubSpot, Notion, Dropbox and Zapier with an original 28-step CSV, a retention decision table and a same-day sequence. No live offboarding was performed for this article, cost figures are illustrative assumptions rather than vendor pricing, and nothing here is employment-law, final-pay or data-protection advice. Those rules vary by jurisdiction and contract.

Download the Employee IT Offboarding Checklist

Download the free 28-step employee IT offboarding checklist CSV. Each row has an ID, phase, task, owner role, dependencies, target timing, acceptance evidence, a status field and space to link the evidence you kept. No signup is required. It is an original Softora worksheet, not an export from any HR or identity product, so import it into a spreadsheet or map it into your task tool and assign named people before you rely on it.

The dependency column is the point of the file. Preservation tasks such as transferring files and deciding how the mailbox will be handled must be complete before the account is deleted, and reassignment tasks in the CRM and automation tools must be complete before those seats are deactivated. If your task tool cannot enforce dependencies, keep the order by only marking a revocation task as ready when the rows it depends on show acceptance evidence.

Two rows deserve attention before anyone leaves. EMP-09 asks whether a legal hold or retention rule applies to any data store, and EMP-03 asks you to choose between the planned sequence and the compressed same-day sequence. The answers change which steps run on the last day and which ones can wait until the following week. A checklist that skips both questions produces tidy-looking completion with the wrong risks accepted.

Step 1: Start From an Authorized Trigger and Pick the Sequence

Offboarding should start from a written trigger: a resignation acknowledged by the manager, a termination decision from the owner, or a contract end date. Rumor, a Slack message or an overheard conversation is not a trigger, because suspending someone's account early creates its own legal and relationship problems. The HR owner records the departure type and the last working day, and the business owner names a coordinator and a backup so the process does not stall when one person is on leave.

The departure type determines the sequence. For a planned resignation with two or more weeks of notice, the person can help: they can transfer their own secondary calendars, hand over document locations, and turn off scheduling pages that cannot be transferred by an administrator. For an involuntary same-day departure, the person is not available and may not be cooperative, so the coordinator runs the compressed order described later in this guide, where sign-in revocation happens first and preservation follows from administrator consoles.

Set a precise revocation time rather than a date. Microsoft documents that a user's access token is good for an hour and that blocking sign-in can take up to 24 hours to take effect, which is why its guidance leads with resetting the password and signing out of all sessions. Google documents that suspension resets sign-in cookies for browsers and mobile devices but does not sign the user out of apps such as Gmail and Drive for desktop. If the agreed time is 5:00 pm on the last day, the coordinator should expect a lag and plan the steps that cover it.

Finally, decide who tells the departing employee what will happen. Slack states that people are not notified when their account is deactivated, HubSpot states that deactivated users receive an email, and Google and Microsoft leave notification to you. A short message from the manager explaining when access ends and how to request personal items avoids surprise and reduces the chance of a last-minute bulk download that you would then need to investigate.

Step 2: Inventory Every Account, Secret and Dependency

Small businesses rarely have a single directory that controls every application. A realistic inventory has five categories: accounts provisioned through your identity provider or Google Workspace and Microsoft 365 sign-in, accounts created directly with a work email and password, shared logins such as a social media account used by three people, secrets the person could see in a password manager or a spreadsheet, and automations or integrations authenticated as the person. The last category is the one most checklists miss and the one most likely to fail silently.

Build the inventory from evidence, not memory. Export the user list from each admin console you know about, search the company mailbox for sign-up and verification emails addressed to the person, check the password manager for vaults they belong to, and ask their manager which client portals, ad accounts and vendor dashboards they used. In HubSpot, list the records, scheduling pages, round-robin links and rotations the user owns or appears in, because HubSpot documents that meetings continue to be booked for a deactivated user who remains in those tools.

Record personal-account dependencies explicitly. Zapier documents that connections are owned by a user and that a Team or Enterprise administrator can change the owner or replace the connected account, but a connection created on a personal account under the person's own name is not something you can transfer at all. GitHub notes that removed members may still have local copies of repositories and that forks in other organizations retain their own access, so your inventory should also capture places where company code or data lives outside your control.

The inventory should finish with a list of devices: company laptops and phones, personal devices enrolled in management, and personal devices that merely have mail or Drive configured. Google documents account wipe and device wipe as separate actions, and Microsoft's remove-former-employee series includes a mobile device wipe step. You cannot plan recovery or remote wipe for a device nobody wrote down.

Step 3: End Sessions First, Then Block Sign-In

On Microsoft 365, the documented first step is to reset the password and then select Sign out of all sessions on the user's Account tab, with the note that the user is prompted to sign in again within an hour or when they leave the current page. Blocking sign-in is a separate action that Microsoft says can take up to 24 hours. For a faster cut, Microsoft points to the Revoke-MgUserSignInSession PowerShell cmdlet, and its step-7 guidance documents expected delays of about 30 minutes through the Exchange admin center, 60 minutes through the Microsoft Entra admin center and three hours or more in an on-premises directory synchronized to the cloud.

On Google Workspace, suspending the user blocks access to services, blocks new email and calendar invitations and keeps all data, and Google's sign-out guidance states that suspension automatically resets sign-in cookies. The same page is explicit that resetting sign-in cookies does not sign the user out of apps such as Gmail and Google Drive for desktop, and it documents a separate control for revoking third-party apps that were granted access to the user's data. Treat those as three items on the checklist, not one.

Deactivation in collaboration tools is usually also a session action. Slack documents that a deactivated member is removed from all channels, signed out of the workspace on all devices and unable to sign back in, and that their API tokens are revoked. Notion documents that a removed member instantly loses access to the workspace. GitHub removal cuts access to the organization's private repositories, but GitHub reminds you that the person may still hold local copies, which is a contractual rather than a technical control.

Record a timestamp for each of these actions. If a dispute later turns on whether the person could reach the CRM after 5:00 pm, an entry that says 'HubSpot user deactivated 17:04, confirmation email received' is worth far more than a ticked checkbox. HubSpot itself documents that deactivation can take up to five minutes to apply across its systems, so a test sign-in attempt a few minutes later is a reasonable piece of evidence.

Step 4: Keep the Mailbox Working Without Paying for a Ghost Seat

The mailbox is where small businesses either overspend or lose history. In Microsoft 365, the documented options are to convert the mailbox to a shared mailbox or to forward new mail to a colleague. Microsoft states that a shared mailbox does not need a license as long as it is smaller than 50 GB, that converting keeps the existing email and calendar available to several people, and that forwarding only delivers new messages. Both options require the account to remain: Microsoft is explicit that you should not delete the account if you have set up forwarding or a shared mailbox, because the account anchors them.

Microsoft's overview also documents the retention behaviour that trips people up. When you remove or delete a license, the former employee's email, contacts and calendar are retained for 30 days and then deleted permanently. If you remove the license but keep the account, OneDrive content remains accessible to you beyond 30 days; if you delete the account, OneDrive and Outlook content is retained for 30 days during which you can restore the account. The practical rule is to give a colleague access to the mailbox and OneDrive before you touch the license.

Google Workspace has no free shared-mailbox conversion, so the options are different. Google states that suspended accounts are still charged at the same rate as active accounts on both the Annual and Flexible plans, which makes indefinite suspension an expensive way to keep a mailbox. The Archived User route keeps the data, blocks sign-in and incoming mail, frees the active license for reassignment within 24 hours, and requires an Archived User subscription on supported editions. Deleting the user with a data transfer keeps Drive and primary calendar data but not the mailbox, and Google states that the email address is removed from Workspace 20 days after deletion unless you reassign it to another user first.

Whichever platform you use, cancel the departing person's meetings. Microsoft documents that meetings created by a former user which booked rooms or equipment keep those resources unavailable until the meetings are cancelled, and Google documents that a deleted owner's secondary calendars and events are deleted with them. Cancelling recurring meetings and re-creating the important ones under the successor is tedious, but it is far less tedious than discovering in January that the all-hands series vanished.

Step 5: Transfer Files and Calendars Before Any Deletion

Google's delete-a-user guidance is built around a single warning: any data that is not transferred is deleted, and some data is retained for 20 days during which you can restore the user. Administrators can transfer Drive and Docs files the user owns, but Google notes this does not include files in shared drives, which already belong to the organization. Super administrators can transfer Drive files, primary calendar data and Looker Studio assets during the deletion flow; other administrators must complete transfers before deleting.

Two Google details matter for the successor. First, if you do not tick the option to include files that are not shared with anyone, ownership of private files can still move when they sit inside a shared folder, and shared files inside an unshared folder can transfer without the folder itself, leaving them unbrowseable. Google documents the Drive search is:unorganized owner:me so the new owner can find them. Second, group calendars and other secondary calendars are deleted when their owner is deleted and cannot be transferred afterwards, so Google recommends transferring calendars before deletion, ideally by asking the departing user to do it while they still can.

Microsoft's model differs: rather than transferring ownership, you grant another user access to the former employee's OneDrive and Outlook data, and that access survives as long as the account exists or is restored within the 30-day window. Dropbox team accounts use a one-time account transfer that can run when you delete the member or later from the Removed list, with the recipient required to be a current team member and an optional remote wipe of the person's connected devices. Dropbox states you can use account transfer only once per member, so pick the recipient deliberately.

Verify transfers from the successor's own session. A confirmation email from the console says the operation ran; it does not prove the successor can open the budget spreadsheet or that the unorganized-files search is empty. Record the check in the evidence column, and if the departing person worked with external clients, see the related client offboarding checklist for the asset-ownership questions that apply to client-held accounts.

Step 6: Deactivate Chat, Docs and Code Hosting Without Breaking Them

Slack's deactivation documentation answers the main data question directly: deactivating a member does not delete their messages or files. It also contains a blocker that catches small teams. No one can deactivate the Workspace Primary Owner, so if the departing founder or office manager holds that role, they must transfer ownership first. On the apps side, Slack's deactivated-member app guidance states that the member's API tokens are revoked, that apps requiring member-specific permissions may be fully deactivated, and that bot users, slash commands and incoming webhooks remain active. If an internal app's only collaborator is deactivated, the app may be deactivated too, and reactivated bots receive regenerated tokens that your code must be updated to use.

Notion's member management guidance states that removing a member instantly ends their workspace access and hides the pages from their Private section. Those pages are unhidden if the member is invited back, and Notion documents that someone who leaves and rejoins within 30 days has private pages, shared pages, group membership and teamspace membership restored. The operational lesson is that company documentation living in a departing person's private pages is not deleted but is also not reachable by anyone else, so ask them to move it into a teamspace before their last day.

GitHub's member-removal documentation lists the consequences: the person loses access to private forks of the organization's repositories but may keep local copies, pending invitations they sent are cancelled, membership data is saved for three months so a reinstated member regains private forks, and on volume licensing the paid seat count does not automatically downgrade. GitHub also recommends sharing a leaving checklist with the person so they remove confidential material and detach their personal account from company resources.

Treat repositories, Slack apps and Notion pages that the person solely owns as transfer tasks, not revocation tasks. The CSV places them in EMP-15 with a dependency into EMP-19 so that the deactivation step cannot be marked complete until a new owner is confirmed in each tool. Where a tool has no ownership transfer, document the recreation under a role-based account and the date it was tested.

Step 7: Reassign CRM Records and Automation Connections

HubSpot's deactivation and removal guidance separates two actions. Deactivating keeps the user profile and historical activity for reporting, keeps the user assigned to their records, stops notifications and makes the seat not count against the total; removing requires deactivation first and unassigns the user from conversations and assets. HubSpot recommends reassigning owned assets before deactivation and removing the user from filters and workflows that reference them, and it documents that deactivation can take up to five minutes to apply.

The scheduling details are where revenue leaks. HubSpot states that if a deactivated user still owns a scheduling page, sits in a group or round-robin page or is part of a meeting rotation, meetings continue to be booked for them, the user is not notified, and those meetings do not appear on the contact's activity feed. It also states that a user's default meeting link cannot be deleted or transferred by someone else, so the documented fix is to ask the person to turn off their scheduling pages before deactivation or to fully remove the user afterwards. Connected individual inboxes are disconnected on deactivation while team inboxes stay connected, and a user listed as a billing point of contact must be replaced.

Automation platforms need the same ownership thinking. Zapier's app connection management documents a Replace connection action that switches every Zap, agent and automation using the connection to a different signed-in account, and a Change owner action on Team and Enterprise plans that changes who owns the connection while leaving the authenticated account unchanged. The second does not help when the authenticated account is the departing person's own Google or Slack login, which will stop working when you suspend it. Zapier also notes that stopping the sharing of a connection pauses any published Zap that relies on it.

The reliable pattern is to authenticate integrations with a role-based account such as automation@yourcompany that is owned by the business, has its own strong credentials in the password manager and is never assigned to a person. Migrating existing connections to that account during offboarding is more work than a one-line reassignment, but it is the only version that survives the next departure. Compare automation tools on this basis in our no-code automation category.

Step 8: Rotate Shared Secrets and Recover Devices

A password manager is the right place to see what a departing person could reach, which is why it belongs in the inventory and not only in the revocation list. 1Password's team member guidance documents a temporary suspend and a permanent delete, and both share a caveat small businesses should read twice: the person's data is removed from their app and device only if they are connected to the internet and 1Password is unlocked. If they are offline when you act, their items remain accessible until the next time they try to unlock while online. 1Password also notes that automated provisioning from an identity provider can override a manual suspension unless the person is removed from provisioning scope.

Because of that caveat, suspension is the start of secret rotation rather than the end of it. Every shared credential the person could see should be changed: social media logins, vendor portals, the Wi-Fi password written on the whiteboard, API keys stored in a shared vault and recovery codes for the owner's accounts. Prioritize by blast radius. A payment processor or domain registrar login comes before a stock photo subscription. Record each rotation date in the CSV, and if you do not have a password manager yet, start with our guide to free password managers.

Devices and multi-factor methods close the loop. Google documents wiping corporate data from a managed mobile device and notes the user can still reach data through web apps and other authorized devices until the account itself is suspended; Microsoft's series includes wiping and blocking a former employee's mobile device. Remove the person's phone from any authenticator or SMS method on shared accounts, and collect hardware keys. A business phone handed back with the authenticator still registered is a live second factor in a drawer.

Decide in advance what happens to personal devices. If an employee used a personal laptop with company mail configured, you can remove the account from the server side and revoke its sessions, but you cannot verify what was cached locally. That is a contractual and policy matter, which is why many small businesses either provide devices or require enrollment before granting access. The checklist records the decision; it does not pretend a technical control exists where it does not.

Suspend, Archive or Delete: Choosing the Retention State

After preservation and revocation, the account ends in one of three states, and each has a documented cost and retention profile. On Google Workspace, suspension keeps everything and keeps charging the full seat; archiving keeps data, blocks sign-in and new mail, counts toward pooled storage and frees the active license within 24 hours in exchange for an Archived User subscription; deletion transfers what you choose, retains data for 20 days for restore, and removes the email address after 20 days unless reassigned. Google's restore guidance adds that restoration needs an available license and usually takes up to 24 hours, occasionally up to five days.

On Microsoft 365, removing the license is the economical middle state: the account stays, OneDrive remains accessible to administrators, but email, contacts and calendar are retained only 30 days after license removal. Converting to a shared mailbox under 50 GB keeps everything at no license cost as long as the account is not deleted. Deletion makes the account inactive for approximately 30 days with restore possible, after which content is gone. Microsoft's series also notes that organizations synchronizing from a local Active Directory must delete and restore there, not in the Microsoft 365 admin center.

Use three questions to choose. Does any legal hold or retention rule apply? If yes, archive or hold rather than delete, and document who decided. Does a colleague still need to receive mail sent to the address? If yes on Microsoft, convert or forward and keep the account; if yes on Google, reassign the address or set up a group alias before the 20-day removal. Is the seat cost material? If yes, do not leave a Google user suspended for months, because the full rate continues.

Write the chosen state and its review date in the close-out row. 'Archived 12 November, review 12 May' is a decision; 'suspended' with no date is a slowly growing bill. The table in this section summarizes the documented behaviour so the decision can be made quickly during the exit week rather than researched from scratch each time.

Worked Example: A 12-Person Business Offboards a Marketing Coordinator

Consider a fictional twelve-person e-commerce business on Google Workspace, Slack, HubSpot, Zapier and 1Password whose marketing coordinator resigns with two weeks' notice. The coordinator owns the editorial calendar in Google Calendar, the product photography folders in Drive, three HubSpot scheduling pages used in email campaigns, and a Zapier connection that posts new orders into a Slack channel using their own Google and Slack logins. None of this is unusual, and none of it is visible in a single admin console.

The planned sequence runs like this. In week one the manager and coordinator move the photography folders into a shared drive, the coordinator transfers the editorial calendar to the successor and turns off their HubSpot scheduling pages, and the operations lead creates a role-based automation account, replaces the Zapier connections with it and confirms a test order posts to Slack. In week two the coordinator transfers ownership of two Looker Studio reports and the successor confirms every file and report opens from their own session. On the last day at 5:00 pm the coordinator's Google account is suspended, third-party app access is revoked, Slack and HubSpot users are deactivated, the 1Password account is suspended, and the phone is returned and checked for authenticator entries.

The cost comparison below uses assumed figures, not vendor pricing: a $14 monthly seat, a $4 monthly archived-user rate and a $40 internal hourly rate. Over six months, leaving the account suspended costs $84 in seat fees, archiving costs $24 and deleting after transfer costs nothing in fees, while the administrative work of inventory, transfers, verification and rotation is the same in all three paths at about 6.5 hours. Even on these modest assumptions the suspended path is the most expensive and the least deliberate, and the time cost dwarfs the seat cost, which is the argument for a reusable checklist rather than ad hoc effort.

The example also shows what would have broken under the revoke-first approach. Suspending the coordinator's Google account on day one would have stopped the Zapier order notifications immediately, hidden the editorial calendar from everyone, and left HubSpot booking meetings with a person who could no longer see them. Each failure would have surfaced days later as a complaint rather than as a ticked box.

Same-Day Departures: The Compressed Sequence

When a departure is immediate, the order inverts: revoke first, preserve from the console afterwards. The reason this is acceptable is that suspension on Google and reset-plus-sign-out on Microsoft keep the data, so the business loses nothing by cutting access immediately as long as nobody deletes anything in the first week. The coordinator's job on the day is to make the account unreachable, stop meetings and automations from misfiring, and avoid any irreversible action.

In the first hour: reset the password and sign out of all sessions or suspend the account, revoke third-party app access, deactivate Slack and other chat tools, suspend the password manager account and remove the person from any shared-account authenticator. In the first day: deactivate the CRM user after reassigning records, replace automation connections if the person's own login was used and watch for failed runs, cancel room and equipment bookings, and begin the device recovery conversation through HR. In the first week: complete file and calendar transfers from the admin console, decide the mailbox state, rotate shared credentials by blast radius and run the verification rows.

Two things should not happen on day one. Do not delete the account, because Google's secondary calendars and Microsoft's forwarding anchor are lost or disabled at deletion and the restore windows start running. Do not remove the person from the password manager before you have listed the vaults they belonged to, because that list is your rotation plan. The compressed table in this section gives the hour-by-hour version for the coordinator to follow under pressure.

Involuntary departures also raise the chance that the person acts before you do. If the inventory from Step 2 already exists for everyone, the coordinator is executing a list rather than discovering one, and the gap between the HR conversation and the first revocation can be minutes. That is the strongest practical argument for keeping a current access inventory for the whole team, not building one per departure.

Troubleshooting Access That Will Not Die and Data That Disappears

The person can still read email on their phone an hour after the reset. On Microsoft 365, this is consistent with the documented one-hour access token and the note that Outlook on the web may not sign the user out until they move to another tile or refresh. Use the Exchange admin center or PowerShell for the fastest documented termination, and confirm the mobile device wipe step ran. On Google, confirm the account is suspended rather than only cookie-reset, because Google documents that cookie reset alone does not sign out desktop apps.

A Zap or integration stopped the day after the departure. Check whether the underlying connection was authenticated as the person; Zapier's Change owner action does not alter the authenticated account, so a connection that still points at the departed user's Google login fails when that login is suspended. Replace the connection with the role-based account and re-test. In Slack, check the deactivated apps list, because Slack documents that apps requiring member-specific permissions may be deactivated with the member and that reactivated bots receive new tokens.

A shared calendar or report vanished. If the owner was a deleted Google user, the secondary calendar is gone with them and Google states no further transfers are possible after deletion; restore the user within 20 days if the data matters, then transfer and delete again. If a Looker Studio report disappeared, the transfer of Looker Studio assets happens either in the super-admin deletion flow or manually beforehand; a report the successor was merely viewing was never theirs.

Contacts keep booking meetings with the former employee. HubSpot documents exactly this outcome when a deactivated user remains on a scheduling page, group page or rotation. Remove them from those tools and, because the default meeting link cannot be transferred, fully remove the user after deactivation if they could not turn it off themselves. In every one of these cases the fix is faster when the inventory row exists, which is why troubleshooting is listed after the inventory and not instead of it.

Sources, Scope and Making the Next Offboarding Routine

Vendor behaviour in this guide was checked on November 8, 2026 against Microsoft's remove-former-employee series (overview, step 1, step 4 and step 7); Google Workspace administrator help for deleting a user, suspending a user, restoring a deleted user, signing a user out and archiving former employees; Slack's deactivation and deactivated-member apps articles; GitHub's removing a member documentation; 1Password's add and remove team members guide; HubSpot's deactivate and remove users article; Notion's manage members and guests help; Dropbox's transfer a former member's files article; and Zapier's manage app connections documentation.

Retention windows, license behaviour and admin-console labels change. Recheck the linked pages before relying on a specific number such as 20 or 30 days, and prefer the vendor page over this summary where they differ. The checklist, worked example, cost assumptions and sequences are original editorial material. The credited photographs illustrate conversations, locked devices and laptop work; they are not records of an offboarding performed for this article. Employment, final pay, notice and personal-data obligations vary by jurisdiction and are outside this guide's scope.

To make the process routine, keep the access inventory current for every employee rather than building it at departure, authenticate automations and integrations with role-based accounts, store shared credentials only in a password manager with vault membership you can list, and keep the completed CSV for each departure with its exceptions. When the next resignation arrives, the coordinator should be executing a known list in a known order. For the HR side of the exit, see our guides to HR and payroll software and the Homebase vs Gusto comparison.