# Employee Offboarding It

> Use when performing employee offboarding it — iT offboarding workflow for departing employees covering access revocation, device collection, data handling, license reclamation, and compliance documentation. Ensures all IT access is properly removed, company assets are returned, and data retention policies are followed during employee separation.

- Skill: `cloudthinker-ai/employee-offboarding-it` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cloudthinker-ai/employee-offboarding-it`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cloudthinker-ai/employee-offboarding-it/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- Author: cloudthinker-ai (https://skillmd.com/u/cloudthinker-ai)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/cloudthinker-ai/employee-offboarding-it

---


# Employee IT Offboarding Workflow

IT offboarding for **{{ employee_name }}** ({{ department }})
Last Day: **{{ last_day }}** | Manager: {{ manager_name }} | Type: {{ separation_type }}

## Phase 1 — Pre-Departure (3-5 business days before last day)

### Access Audit
- [ ] Inventory all systems and applications {{ employee_name }} has access to
- [ ] Document all group memberships and role assignments
- [ ] Identify any shared accounts or service accounts managed by the employee
- [ ] Check for any API keys, tokens, or secrets created by the employee
- [ ] Review file shares and cloud storage permissions

### Data Handling
- [ ] Coordinate with {{ manager_name }} on data transfer requirements
- [ ] Identify critical files that need to be transferred to a colleague
- [ ] Back up email mailbox per retention policy
- [ ] Back up personal drive / OneDrive / Google Drive per retention policy
- [ ] Document any knowledge transfer requirements

### Device Planning
- [ ] Identify all company devices assigned to {{ employee_name }}
- [ ] Schedule device return (in-person or shipping label for remote)
- [ ] Prepare device wipe checklist

## Phase 2 — Last Day (end of business on {{ last_day }})

### Immediate Access Revocation
- [ ] Disable Active Directory / identity provider account
- [ ] Revoke SSO access (all connected applications disabled automatically)
- [ ] Disable email account (convert to shared mailbox if needed)
- [ ] Revoke VPN access
- [ ] Remove from MFA/2FA
- [ ] Disable remote access tools
- [ ] Revoke badge/physical access (coordinate with facilities)

### Application-Specific Revocation
- [ ] Remove from Slack / Teams / collaboration platforms
- [ ] Revoke access to source code repositories (GitHub, GitLab, Bitbucket)
- [ ] Remove from cloud console access (AWS, Azure, GCP)
- [ ] Revoke ITSM portal access
- [ ] Remove from SaaS applications not covered by SSO
- [ ] Revoke any delegated admin permissions

### Communication
- [ ] Set up email auto-reply / forwarding (per policy, max 30 days)
- [ ] Update voicemail greeting if applicable
- [ ] Remove from email distribution lists

## Phase 3 — Post-Departure (within 5 business days)

### Device Processing
- [ ] Collect all company devices (laptop, phone, tablet, peripherals)
- [ ] Verify device encryption status before wipe
- [ ] Perform secure data wipe on all returned devices
- [ ] Update asset management records (return to inventory)
- [ ] Reclaim software licenses from device

### License Reclamation
- [ ] Reclaim all named-user software licenses
- [ ] Deactivate license seats for SaaS tools
- [ ] Update license count in asset management

### Compliance & Documentation
- [ ] Confirm all access has been revoked (audit log review)
- [ ] Document offboarding completion in ITSM
- [ ] File offboarding checklist for compliance records
- [ ] Notify {{ manager_name }} of completion
- [ ] Close offboarding ticket

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format

Generate a tracked offboarding report with:
1. **Summary** with employee details and completion status
2. **Access revocation checklist** with timestamps
3. **Asset return status** with device details
4. **Compliance sign-off** confirmation