Every growing company eventually hits the same wall: hiring speeds up, and IT can’t keep pace. A new hire’s laptop isn’t ready on day one. Login credentials go out a week late. Or worse — an employee leaves the company, and nobody remembers to revoke their access to the CRM, the shared drive, or the finance system for another three weeks.
None of this is really an “HR problem” or a “manager problem.” It’s an IT support problem, and it’s one of the most overlooked areas of operational risk for scaling businesses. Onboarding and offboarding sit at the intersection of productivity, security, and compliance — and a weak process in either direction costs real money, whether through lost productivity in the first case or a data breach in the second.
This guide breaks down exactly what a mature IT help desk should be doing before, during, and after every hire and every exit — organized as a practical checklist you can use as-is or adapt to your environment.
Table of Contents
Why Onboarding & Offboarding Deserve Their Own IT Playbook
Most companies treat onboarding and offboarding as HR-led processes with IT as a downstream participant — someone HR emails when a new hire’s start date is confirmed, or notifies (sometimes late) when someone resigns. That reactive model works fine at 15 employees. It breaks down fast at 50, and becomes a genuine liability at 150+.
A few reasons this deserves dedicated attention from your IT help desk:
- First impressions matter. A new employee’s first two hours on the job often involve waiting for laptop setup, password resets, or software access. That’s a poor start to their tenure and a signal about how the company operates.
- Access sprawl is a security time bomb. The average employee touches a dozen or more SaaS tools, shared drives, and internal systems. Every one of those is a potential entry point if access isn’t cleanly revoked.
- Offboarding failures are the #1 quiet cause of breaches. Former employees retaining access — intentionally or through oversight — is one of the most common and preventable causes of data exposure in small and mid-sized businesses.
- Compliance frameworks require it. SOC 2, ISO 27001, HIPAA, and similar frameworks all have explicit controls around user access provisioning and deprovisioning. Auditors will ask for evidence.
- IT asset costs pile up unnoticed. Unused software licenses tied to former employees, laptops that never get recovered, and forgotten subscriptions quietly drain budget month after month.
The fix isn’t complicated, but it does require a documented, repeatable process — the kind a dedicated managed IT services partner or an internal help desk team can own end-to-end.
The Business Cost of Getting This Wrong
Before the checklist, it’s worth being specific about what “getting it wrong” actually costs, because that’s usually what gets budget approved for fixing it.
On the onboarding side:
- Lost productivity in week one, when a new hire can’t log in, can’t access files, or is waiting on IT tickets instead of doing their actual job.
- Manager and buddy time spent troubleshooting instead of training.
- A poor first impression that measurably affects early retention — new hires who have a rocky first week are statistically more likely to disengage early.
On the offboarding side:
- Continued access to email, cloud storage, CRM records, or financial systems after termination — a direct security and compliance exposure.
- Orphaned SaaS licenses that keep billing the company for accounts nobody uses.
- Missing hardware that was never formally checked back in, creating both a financial loss and, if the device held sensitive data, a potential breach.
- Failed audits, because there’s no clean access log showing when accounts were disabled relative to the termination date.
None of these are hypothetical. They’re the recurring findings IT help desk teams see when they take over support for a company that’s been running onboarding and offboarding informally.
The IT Help Desk Onboarding Checklist
A well-run onboarding process breaks into three phases: before day one, day one itself, and the first 30 days. Skipping the “before” phase is the single most common mistake — most onboarding friction happens because IT only starts working once the new hire is already sitting at their desk.
Phase 1: Pre-Boarding (5–10 Business Days Before Start Date)
- Confirm the new hire’s role, department, and manager with HR, so IT can map the correct access profile (not a generic “new employee” template).
- Provision hardware — order or allocate a laptop/desktop, and any peripherals the role requires (headset, second monitor, mobile device).
- Create core accounts: email/identity account, single sign-on (SSO) profile, and any directory entries (Active Directory / Azure AD / Google Workspace).
- Assign role-based access to SaaS tools and internal systems — using a predefined access template per department/role rather than ad hoc requests.
- Pre-configure the device: OS updates, antivirus/EDR agent, VPN client, MDM enrollment, standard software bundle, and security policies (disk encryption, screen lock).
- Set up multi-factor authentication (MFA) and document the enrollment steps for the new hire.
- Prepare login credentials and a secure method to deliver them (never over unencrypted email or plain chat).
- Add the new hire to relevant distribution lists, calendars, and collaboration channels (Slack/Teams, project boards, shared drives).
- Test everything — log in as the profile (or a test account) to confirm access works before day one.
Phase 2: Day One
- Hand off or ship the device, fully configured and ready to use out of the box.
- Walk through account access and MFA setup with the new hire, either in person or via a scheduled remote session.
- Confirm access to all required tools — email, HR/payroll self-service, CRM, project management, file storage — and flag any gaps immediately.
- Provide a quick-reference IT guide: how to reach the help desk, how to report an issue, password reset self-service instructions.
- Log the new asset in your IT asset management system, tied to the employee’s record, with serial number, model, and assigned date.
- Open a “new hire” ticket in the help desk system so any day-one issues are tracked and resolved with visibility, not lost in a Slack thread.
Phase 3: First 30 Days
- Check in proactively at day 3–5 and again at day 30 to catch access gaps or recurring friction points the new hire may not think to report.
- Confirm software licenses are correctly assigned (not duplicated, not missing).
- Verify security training completion — phishing awareness, acceptable use policy acknowledgment, data handling training if relevant to the role.
- Close out the onboarding ticket with a documented record of what was provisioned, when, and by whom — this becomes your audit trail.
A help desk running this consistently, hire after hire, doesn’t just look more professional — it removes IT as a bottleneck to productivity and gives HR a partner they can rely on instead of chase down.
The IT Help Desk Offboarding Checklist
Offboarding gets less attention than onboarding, but it carries more risk. The core principle: access should be revoked at the moment employment ends — not the end of that week, not “whenever IT gets to it.” That requires a tight handoff between HR/management and IT, ideally automated through your identity provider.
Phase 1: Pre-Departure Planning (When Notice Is Given, or Immediately for Involuntary Exits)
- Get the exact last-day-of-access time from HR/manager — this may differ from the last day of employment, especially for involuntary terminations, where access should typically be cut immediately.
- Identify every system the employee has access to — pull from your access management/SSO logs rather than relying on memory or a static spreadsheet.
- Flag high-risk accounts — admin credentials, financial system access, customer data access, shared/service accounts they may know the password to.
- Plan data handoff — what files, email, and CRM records need to be transferred to a manager or replacement before the account is disabled.
- Coordinate timing with HR and the employee’s manager so the IT action lines up precisely with the termination timeline. This is especially critical for involuntary or contentious departures.
Phase 2: Departure Day
- Disable the identity/SSO account first — this is the highest-leverage action, since most connected apps inherit access through SSO.
- Revoke MFA tokens and active sessions across all devices, not just disable login going forward.
- Reset or remove passwords on any shared/service accounts the employee had access to.
- Disable email, and set up forwarding or an auto-responder only if approved by HR/management — don’t leave the mailbox live indefinitely.
- Remove access to SaaS tools individually if they aren’t behind SSO (CRM, finance software, marketing platforms, code repositories).
- Revoke VPN and remote access credentials.
- Retrieve company hardware — laptop, phone, access badges, security tokens — and log the return in your asset management system.
- Wipe and reimage returned devices before reissuing them, following a documented data-sanitization process.
- Remove the employee from distribution lists, shared calendars, and collaboration tools.
Phase 3: Post-Departure Cleanup (Within 5–10 Business Days)
- Reassign or cancel software licenses tied to the former employee to avoid continued billing.
- Archive the employee’s data according to your data retention policy, then transfer or delete as appropriate.
- Audit for any missed access points — this is where a checklist genuinely earns its keep, since informal offboarding almost always misses at least one system.
- Document the offboarding action with timestamps for every step — this record is what you’ll hand an auditor if asked to prove access was revoked promptly.
- Close the offboarding ticket and update the asset management and HR systems with final status.
Why a Checklist Alone Isn’t Enough
A checklist gets you consistency, but consistency without the right tooling and staffing still breaks down under volume. A few things separate companies that handle this well from companies that only look like they do:
1. Centralized identity management. If access to most tools flows through a single sign-on provider, one action — disabling the SSO account — cascades correctly and instantly across dozens of connected apps. Without SSO, offboarding becomes a manual checklist across every individual tool, which is exactly where things get missed.
2. A documented, role-based access model. New hires should be provisioned against a template tied to their role and department, not assembled ad hoc by whoever is handling the ticket that day. This also makes offboarding faster, because IT already knows what access that role typically has.
3. A shared system of record between HR and IT. The single biggest failure point in offboarding is a timing gap — HR knows someone is leaving, but IT finds out late, or finds out informally. Automated triggers from your HRIS to your help desk ticketing system close that gap.
4. Dedicated ownership. Someone — whether an internal IT help desk team member or an outsourced IT service desk provider — needs to own the onboarding/offboarding workflow specifically, rather than treating it as background noise alongside general ticket volume.
5. Regular audits. Quarterly access reviews catch what the process misses. Even a well-run offboarding checklist occasionally lets an account slip through, particularly for tools that sit outside SSO.
This is exactly the kind of structured, recurring workflow that a managed desktop support or remote IT support partner is built to run — because it’s less about solving a one-off technical problem and more about maintaining a disciplined operational process over time.
Onboarding & Offboarding at Scale: What Changes as You Grow
The checklist above works at almost any company size, but the operating model behind it needs to change as headcount grows.
- Under 50 employees: A single IT generalist or a small internal team can usually run this manually with a shared checklist and a ticketing tool. The risk is inconsistency when that person is out sick or focused elsewhere.
- 50–250 employees: Hiring volume becomes frequent enough that manual tracking starts to fail quietly. This is typically where companies introduce automated provisioning tied to the HRIS, and where a dedicated help desk function — internal or outsourced — pays for itself in reduced downtime and reduced risk.
- 250+ employees or multi-location teams: Onboarding and offboarding usually need to run 24/7 or across time zones, particularly for companies with remote or distributed teams. This is where managed IT services with follow-the-sun coverage becomes valuable — new hires in one region shouldn’t wait until business hours in another region for IT to catch up.
Growing companies that outsource this function typically do it because the process itself is well-understood and repeatable — it doesn’t require deep institutional knowledge, just discipline and the right tooling — which makes it a strong candidate for a help desk partner to own reliably.
Security & Compliance: The Part Most Companies Underweight
Onboarding and offboarding aren’t just operational workflows — they’re control points that auditors and security frameworks care about specifically.
- SOC 2 requires evidence of timely access provisioning and, more scrutinized, timely deprovisioning when employment ends.
- ISO 27001 includes explicit controls (A.9 in earlier revisions) around user access management tied to the employment lifecycle.
- HIPAA, for companies handling healthcare data, requires documented procedures for terminating access to systems containing protected health information.
- Cyber insurance underwriters increasingly ask about offboarding procedures directly during renewal, since delayed deprovisioning is a well-known breach vector.
If your offboarding process today is “someone remembers to email IT,” you don’t have a control — you have a hope. Documented, timestamped offboarding actions (the kind a ticketing system naturally produces) are what turns this into something you can actually show an auditor.
Building vs. Outsourcing This Function
Companies generally land in one of three models:
- Fully in-house. Works well when you already have a dedicated IT team with capacity to own this as a formal process, not an afterthought.
- Fully outsourced. A managed IT help desk handles the entire onboarding/offboarding workflow, integrated with your HRIS and ticketing system, with SLAs around turnaround time for both provisioning and deprovisioning.
- Hybrid. Internal IT owns strategy and exceptions; a service desk partner handles the repeatable, high-volume execution — device staging, account creation, ticket handling.
The right model depends on hiring velocity, in-house IT capacity, and how distributed your workforce is. What matters most isn’t which model you choose — it’s that whichever team owns this treats it as a defined, auditable process rather than a set of individual favors done for HR.
Frequently Asked Questions
How long should IT offboarding take after an employee’s last day?
Access revocation for high-risk systems — email, SSO, VPN, financial and customer data systems — should happen on the employee’s actual last day of access, ideally within the hour for involuntary terminations. Lower-risk cleanup, like license reassignment and hardware audits, can reasonably follow within 5–10 business days.
Who should own the onboarding and offboarding process — HR or IT?
HR owns the employment timeline and communicates dates; IT owns execution of the technical steps. The handoff between the two is where most failures happen, so the process works best when it’s triggered automatically (through an HRIS integration) rather than relying on someone remembering to send an email.
What’s the biggest mistake companies make in IT offboarding?
Disabling email but forgetting SaaS tools that sit outside single sign-on. A former employee’s email might be shut off while they still have live access to the CRM, a shared drive, or a project management tool for weeks afterward.
Do small companies really need a formal checklist for this?
Yes — arguably more than larger companies, because smaller teams often have no backup process if the one person who “knows how to do onboarding” is unavailable. A documented checklist removes that single point of failure at any size.
Can onboarding and offboarding be automated?
Much of it can. Identity providers (like Azure AD, Okta, or Google Workspace) support automated provisioning and deprovisioning tied to HRIS status changes. Full automation isn’t realistic for every step — hardware handling, for instance, still needs a human — but the account-level work is highly automatable.
How does IT asset management relate to offboarding?
Every device and license needs to be tracked against an individual employee so it can be recovered, reassigned, or canceled the moment they leave. Without an IT asset management system, offboarding checklists rely on memory, which is exactly where hardware and licenses get lost.
Getting This Right, Consistently
Onboarding and offboarding will never be the most visible part of an IT function, but they’re one of the clearest signals of how mature that function actually is. A company that gets a new hire fully productive on day one, and fully — and provably — disconnects a departing employee the moment they leave, is running IT as a controlled process rather than a series of favors.
If your current process depends on someone remembering to send the right email at the right time, it’s worth treating this as a project rather than a habit to improve. A documented checklist, backed by a help desk team with the tooling to execute it consistently, closes the gap between “we think we’re covered” and “we can prove we’re covered” — which is exactly what growing companies need as headcount, audits, and hiring velocity all increase at once.
Zenkins’ IT help desk services and managed IT services are built around exactly this kind of repeatable operational workflow — onboarding, offboarding, asset tracking, and access governance — so growing companies don’t have to build the process from scratch or hope it holds together as hiring accelerates. Get in touch to see how a structured onboarding and offboarding workflow could look for your team.
