An employee offboarding checklist for closing IT access gaps

One of the trickiest parts of employee onboarding and offboarding is keeping track of access as it changes throughout the employee lifecycle. By someone’s last day, the list of accounts to close may look very different from the list IT created when they were a new hire.

This employee offboarding checklist covers the IT side of that departure: revoking application access, deprovisioning accounts, and documenting what’s done. It also explains how automation helps carry out those steps without leaving IT to chase every app manually.

The IT offboarding checklist: What needs to happen on the last day

Offboarding isn’t finished just because the employee loses single sign-on (SSO) access. Work through the checklist below to catch access that lives outside your identity provider and confirm each removal is complete.

1. Revoke access to facilities and connected applications

Instead of pulling up the employee’s original onboarding record, start with their current access. Someone who’s changed roles may still have permissions their current manager doesn’t know about.

Access removal involves four checks:

• Remove group-based access: Revoke the memberships that grant application access through providers like Okta or Microsoft Entra.
• Revoke access outside the identity provider: Check separately provisioned SaaS accounts and internal tools.
• Reclaim paid seats: Confirm whether removing access also releases the license or requires another action.
• Revoke physical access: For team members who use company facilities, deactivate badges and remove building access permissions. Make sure physical keys are collected too.

How Serval helps

Serval’s access management uses the configured provisioning method defined for each application to revoke access. It can remove identity provider group memberships, run deprovisioning workflows, or follow other configured paths that match how the app was originally provisioned. That includes applications outside the identity provider once a workflow exists for them.

Teams that automate access requests can define that removal path when access is first granted. But test both provisioning and deprovisioning before relying on automation during offboarding.

2. Deprovision accounts and disable authentication

Removing application permissions doesn’t necessarily disable the account itself. The employee may also have active sessions or credentials that need separate attention.

To close those remaining entry points:

• Disable employee accounts: Confirm the authorized access cutoff time with HR, then disable the primary identity and any accounts with separate login credentials at that time. Preserve business records according to your retention policies.
• Revoke active sessions and tokens: Use each system’s available controls instead of assuming a disabled login ends every existing session.
• Review employee-linked credentials: Revoke personal API keys. Transfer ownership of shared service accounts and rotate credentials the departing employee knew.

How Serval helps

Serval workflows can execute account deprovisioning steps across connected systems. Handling employee-linked API keys and service accounts also requires configured workflows; you can use an available prebuilt workflow or build the required steps in Serval’s Catalyst.

For temporary permissions, just-in-time (JIT) access provisioning reduces the access that accumulates during employment. But you’ll still want to revoke any active grants at departure instead of waiting for their scheduled expiration.

3. Retrieve and wipe company devices

Account for assigned hardware as well as digital access. A laptop in transit still needs protection until IT receives it.

Complete the following device checks:

• Confirm the inventory: Identify assigned equipment and record what’s been returned.
• Arrange remote returns: Provide prepaid return kits and track shipments until they arrive.
• Secure company data: Preserve required records before issuing a lock or wipe command through your device management tool. Verify the device received and completed the command.

How Serval helps

Serval can include device commands in an offboarding journey and assign manual return tasks to the appropriate team. The connected mobile device management (MDM) or unified endpoint management (UEM) tool performs the lock or wipe, with Serval coordinating the step instead of wiping or shipping hardware itself.

4. Verify and document the revocation

A submitted removal request isn’t proof that access is gone. Check the outcome before closing the offboarding ticket.

Your final review should cover:

• Completion in each system: Confirm that the intended accounts are disabled and permissions have been removed.
• Unresolved exceptions: Assign failed or pending actions a named owner and follow-up deadline.
• Evidence of the work: Record the affected account and action taken in the offboarding document. Be sure to include completion timestamps and the authority behind the changes.

How Serval helps

Serval’s run history shows each workflow step’s outcome, and its exportable audit log records access management grants and removals. IT can review what ran and the outcome, then retain that evidence for compliance reviews instead of reconstructing events from chat messages.

Automating IT offboarding: From HRIS event to full deprovisioning

A checklist gives IT a process to follow each time they offboard an employee. Automation connects the departure event to the work itself, which means revocation doesn’t depend on someone noticing a ticket and opening each admin console.

Why manual revocation checklists fail at scale

An employee who’s spent five years at your company may have accumulated access across dozens of applications. Some permissions probably came through IT, while others were granted by individual app owners or carried over from previous roles.

A manual checklist only works if someone hunts down all that access and follows through on every removal. One missed application can leave an orphaned account active while its paid seat keeps billing. Even when the work gets done, IT may have to piece together evidence from separate systems afterward.

How Serval automates offboarding revocation end to end

Serval journeys coordinate the offboarding sequence across connected systems. IT describes the trigger and required tasks in plain language or provides an existing process document. Catalyst then translates it into a journey for IT to review and test before deployment.

The process follows four stages:

1. 1.Start from the departure event: The journey begins when Serval receives a confirmed departure signal. That signal can come from an HR information system (HRIS), such as Workday, which sends structured events when an employee’s status changes. You can also start the journey by entering a departure date directly in Serval if your HRIS doesn’t supply automated triggers.
2. 2.Run the configured removal steps: Serval workflows execute actions across connected systems. Access management revokes grants through their configured provisioning paths.
3. 3.Apply the required controls: Use automated workflow approvals where sensitive actions or exceptions require authorization. Define those gates ahead of time so routine revocation follows the approved process.
4. 4.Track outcomes and outstanding work: Review execution records and assign manual tasks where needed. Each task’s status stays visible within the journey.

Serval also integrates with Rippling to sync workers and groups. Its connector runs background syncs every four hours while access membership changes initiated through Serval happen on demand. That connection alone shouldn’t be treated as an instant termination trigger.

The practical goal is to remove the delay between an authorized departure and execution. Coverage depends on configuring a removal path for each application instead of assuming an HRIS connection handles every account.

What Serval’s offboarding automation doesn’t cover

Serval coordinates the technical work across connected tools. Your MDM/UEM platform performs device wipes, and your logistics provider handles hardware returns. Those actions can sit within the journey as automated steps or assigned tasks.

Payroll still handles final pay, while HR takes care of exit interviews and employment paperwork. Keep those responsibilities with the appropriate team while IT tracks access removal through completion.

Close the gaps in your IT offboarding process with Serval

Your team shouldn’t have to chase down every app owner each time someone leaves. Serval brings offboarding into IT service management (ITSM) with journeys that coordinate departure tasks and workflows that execute configured access removals. Exportable audit logs record access removals made through access management, and the journey shows which tasks still need attention.

Book a demo to see how Serval can turn your employee offboarding checklist into a repeatable workflow.

FAQ

What should a termination checklist for employees include?

A termination checklist should cover everything an employer needs to coordinate across HR and IT. HR handles required paperwork and coordinates final pay, while IT revokes access and arranges equipment returns. Each task needs a deadline and someone responsible for confirming it’s done.

When should offboarding begin after an employee’s resignation?

Offboarding planning should start once the resignation and departure date are confirmed. Use the notice period to arrange knowledge transfer and identify accounts or files that need a new owner. Make sure access removal happens at the authorized cutoff time so former employees don’t retain permissions after departure.

How can exit interview feedback improve IT offboarding?

An exit interview can reveal gaps in the employee experience that IT doesn’t see in tickets. A departing employee might flag confusing equipment return instructions or difficulty transferring ownership of shared files. HR can pass that feedback to IT to improve the checklist and clarify instructions for future departures.