Employee Offboarding Checklist Generator

Free IT offboarding access checklist · pick the leaver's systems · copy, CSV or print · runs in your browser · nothing is uploaded

Someone left. Do they still have Slack, GitHub and AWS access? Most offboarding checklists stop at "disable their email". Tick the systems the person used and this page builds an ordered access-revocation checklist: what to do before the last day, at the cut-off, within 24 hours, within 7 days and within 30 days, with concrete steps for each system (suspend vs delete, sign out sessions, revoke tokens and keys, transfer files, reclaim licences).

Free, and private by design: everything happens in this tab. No account, no upload, nothing saved.

Like the rest of the site, page views may be counted by Cloudflare Web Analytics, which does not see what you type here (see the privacy page).

1. The departure

2. Systems they used

Tick everything the person could sign in to. Unsure? Tick it: an extra line costs less than a missed login.

Offboarding access checklist

Ticks are for this session only: they are not saved. The CSV has Done, Done date and Evidence columns for your own records. Steps follow the vendors' admin help pages (the "source" links), checked 5–6 Oct 2026; menus change, so check the current page. A starting list, not legal, HR or security advice.

Track every leaver, with owners, due dates and evidence

The Employee Offboarding + Access-Revocation Kit is our Excel / Google Sheets version of this checklist. Add a leaver and 42 tasks appear, from before the last day to Day 30, each with an owner, a due date, a Done? column and an evidence column; overdue rows turn red. It also has a SaaS Access Inventory, an Equipment Log, a Final Pay Log (organiser only) and an Audit Summary, plus a 60-minute offboarding guide. No macros.

Solo/SMB $49 (one organisation) · Team/MSP $99 (up to 10 client organisations, plus 13 email and announcement templates) · 14-day money-back guarantee.

See what's in the Offboarding Kit Buy Solo/SMB, $49 Buy Team/MSP, $99

Disclosure: the Offboarding Kit is made by Karuna Labs (that's us). This checklist generator is free either way. Template and organiser only; it doesn't make your systems secure or compliant.

How to use this employee offboarding checklist

  1. Enter the last working day and, if you know it, the access cut-off time. The name and role are optional and only appear on your copy.
  2. Tick every system the person could sign in to, and type any other apps (accounting, design, bank portals) in the box. Each gets its own remove, transfer, rotate and reclaim steps.
  3. Agree an owner for each step. The checklist suggests one (IT, HR, Manager, Payroll, Finance) that you can change in the CSV.
  4. At the cut-off, work through "At exit" in order: identity account first, then everything else, in one sitting.
  5. Copy the list into a ticket, download the CSV into a spreadsheet, or print it, and keep evidence (a ticket number or admin-log screenshot) for each step.

Want the reasoning behind the order? Read the free guide: Employee offboarding checklist: access revocation, Day 0 to Day 30.

FAQ

Is anything I type sent to you or saved?
No. The checklist is built by JavaScript in this browser tab. The form makes no network requests and nothing is written to cookies or local storage, so the name, dates and ticks are gone when you close or reload the page. Copy, download or print the checklist if you want to keep it.
Should I suspend or delete a leaver's account?
Usually suspend or block first, and delete later. Suspending stops sign-in but keeps email and files while you hand them over. Vendors handle deletion differently: Google can restore a deleted Workspace user for up to 20 days, Microsoft keeps a mailbox's email, contacts and calendar for 30 days after the licence is removed, and Salesforce users can only be deactivated, not deleted. That is why this checklist puts deletion in the 30-day step.
Does turning off single sign-on remove access to every app?
Not always. Blocking the identity account stops new SSO sign-ins, but apps with their own password, sessions that are already open, and keys or tokens keep working until you remove them. For example, AWS access keys work without a console password, and Okta deprovisions only the apps that have deprovisioning turned on. List every app and check each one.
What should happen before the employee's last day?
Agree the exact access cut-off time in writing, list every system the person can reach, agree the handover, and ask them to move work items out of private spaces (a password manager's private vault, Notion private pages) into shared ones. For an immediate departure, tick the box on the form and those steps move to right now.
How long should we keep a former employee's email and files?
It depends on your own retention policy, contracts and local law, so this page doesn't set a period. It only reminds you to keep what you need before you delete accounts, and to check the vendor's own retention rules and any holds first.
Is this checklist enough for a compliance or security audit?
No. It is a free starting list of common revoke steps, based on the vendors' admin help pages, not legal, HR or security advice, and using it does not make a company secure or compliant with any law or standard. Vendor menus change, so check each vendor's current help page (linked next to the steps).

More free tools