Employee Onboarding and Offboarding IT Checklist for Small Businesses

A good IT onboarding process gives a new employee the right accounts, devices and access on day one, and nothing more than they need. A good offboarding process removes all of that access on the person's last day, preserves the company data they worked with and recovers company equipment. Both work best as a written checklist that HR, management and IT follow the same way every time.

Most small businesses handle these steps informally, which leads to two common problems: new hires who spend their first days waiting for logins, and former employees who still have access to email, cloud files or business apps months after leaving. A simple, repeatable checklist fixes both.

Why a Checklist Matters

Without a standard process, details depend on who happens to be available. One person gets a laptop with full admin rights; another gets a shared password written on a sticky note. When someone leaves, their mailbox might be deleted before anyone exports important client threads.

A checklist gives you:

• Consistency: every employee gets the same secure setup
• Speed: new staff are productive sooner
• Security: access is granted on purpose and removed on time
• Accountability: you can show who did what and when

Onboarding Checklist

Before the first day

1. HR or the hiring manager notifies IT with the start date, role, department and any special software needs.
2. Create the user account in Microsoft 365 or Google Workspace with a naming convention you use consistently.
3. Assign licenses based on role, not on what the last person had.
4. Add the user to the right security groups, shared mailboxes and Teams or shared drives.
5. Prepare a laptop or desktop: updated operating system, endpoint protection, disk encryption and standard applications.
6. Enroll the device in your management platform. Tools such as Microsoft Intune let you apply security policies and install apps automatically.

On the first day

1. Have the employee set their own password and register multi-factor authentication in person or on a verified call.
2. Walk through how to request IT help and how to recognize phishing.
3. Confirm access to every system they need: email, line-of-business apps, printers, phone system.
4. Review the acceptable use policy and have it acknowledged.

In the first two weeks

• Check in to confirm nothing is missing
• Remove any temporary access granted during setup
• Confirm the device is reporting correctly to monitoring and backup tools

Offboarding Checklist

Offboarding is where most security gaps appear. Treat it with the same care as onboarding.

Before or on the last day

1. HR notifies IT of the departure date and whether the exit is voluntary or not. For sensitive departures, plan to disable access at the moment the conversation happens.
2. Disable sign-in to the main account rather than deleting it immediately.
3. Reset the password and revoke active sessions so phones and browsers are signed out.
4. Remove the user's MFA methods and any registered devices.
5. Convert the mailbox to a shared mailbox or set up forwarding to a manager, according to your policy.
6. Transfer ownership of important files, shared folders and calendars.

Equipment and access recovery

• Collect laptops, phones, badges, keys and security tokens
• Remotely wipe company data from personal phones enrolled in mobile management
• Change shared passwords the employee knew, such as Wi-Fi, alarm codes or vendor portals
• Remove the person from third-party apps: accounting software, CRM, banking portals, social media accounts

After departure

• Keep the account disabled for a set retention period before deleting it
• Reclaim licenses so you are not paying for unused seats
• Document the completion date and who performed each step

Manual Process vs. Managed Process

Area	Informal, manual approach	Documented, managed approach
Account creation	Done when someone remembers	Triggered by HR notice
Device setup	Hand-configured, inconsistent	Standard image or Intune enrollment
Access rights	Copied from another user	Assigned by role and group
Departure	Password changed, maybe	Full access removal and session revocation
Data retention	Mailbox sometimes deleted	Mailbox and files preserved by policy
Audit trail	None	Dated checklist for each employee

Tips for South Florida Businesses

Many offices in Miami-Dade have a mix of in-office, hybrid and remote staff, and often seasonal or part-time workers. A few practical points:

• Ship pre-configured laptops to remote hires so they can sign in securely from home
• Provide onboarding instructions in English and Spanish when your team is bilingual
• For healthcare practices, make sure access to patient systems is reviewed carefully as part of a HIPAA-aware process

FAQ

Should we delete a former employee's account right away?

Usually not. Disabling the account immediately stops access, while keeping it for a defined period lets you recover email and files if needed. Delete it later according to your retention policy.

Who should own the onboarding and offboarding checklist?

HR typically starts the process, IT performs the technical steps and a manager confirms access is correct. Writing down who is responsible for each step prevents gaps.

How can we speed up onboarding for new hires?

Use role-based templates for licenses and groups, and device management tools that configure laptops automatically. That way setup becomes a predictable, repeatable process.

Make Access Changes Predictable

Core Florida IT helps South Florida businesses build onboarding and offboarding processes that are fast, secure and documented, as part of our managed IT support. Start with a free IT assessment and we will review your current accounts, devices and access controls. Request your free IT assessment.