How to Submit and Manage an Employee Offboarding Request

Offboarding protects company data, preserves business continuity, and removes access at the correct time. The manager or HR representative should submit an approved service-desk request as soon as a departure is confirmed. For an involuntary or high-risk departure, coordinate timing privately with HR, Legal, security, facilities, and IT; do not warn the departing user through a routine ticket notification.

Information the request must include

Provide:

• Employee name, username, department, manager, and location
• Last working date and the exact time and time zone when access must be blocked
• Departure type and whether the action is confidential or high-risk
• Successor or manager who should receive business data
• Required email handling: shared mailbox, forwarding, delegate access, or automatic reply
• OneDrive, SharePoint, Google Drive, shared-drive, and application data that must be retained or transferred
• Company devices, asset tags, accessories, badges, keys, tokens, and expected return method
• Vendor, customer portal, social-media, code repository, password-vault, phone, and building access
• Legal hold, investigation, records-retention, or eDiscovery requirements
• Ownership of recurring meetings, automations, service accounts, domains, billing, and MFA methods

Never put sensitive performance or investigation details in a broadly visible ticket. State only the handling instructions IT needs and use the restricted process defined by HR or Legal.

Secure access in the right order

At the approved cutoff time, IT should block sign-in, revoke active sessions, reset credentials where appropriate, remove MFA methods or tokens, disable VPN and remote access, and address managed mobile devices. Shared credentials must be rotated if the person knew them. Disabling an account is often safer than immediately deleting it because deletion can start retention clocks or remove the ability to transfer data.

Microsoft’s offboarding guidance sequences sign-in blocking, mailbox preservation, mobile-device action, mail routing, OneDrive and Outlook access, license removal, and eventual account deletion. Microsoft warns that after a user account is deleted, its OneDrive and Outlook content is retained for 30 days; administrators should grant access or preserve required content before deletion. Microsoft Learn

For Google Workspace, transfer Drive ownership before deleting the user. Google states that ownership can be transferred between active users in the same organization, and that items in Trash are not included in the transfer. It recommends suspending the source account during the transfer so content cannot change. Google Workspace Admin Help Google also notes that a deleted user generally must be restored within 20 days if an administrator needs to recover the account and transfer its Drive data. Google Workspace Admin Help

Preserve business operations

The manager should identify open work, customer correspondence, owned files, calendars, shared mailboxes, workflows, and application records before the final day. Move team content into approved shared locations rather than leaving long-term records in one person’s private drive. Transfer ownership of forms, dashboards, scripts, scheduled jobs, and recurring meetings. Verify the successor can open the data; a transfer report alone is not enough.

Email forwarding or an automatic reply should have an owner, purpose, and end date. Avoid indefinite monitoring of a former employee’s mailbox. Access must comply with company policy, privacy obligations, and Legal instructions.

Recover all company equipment through a documented chain of custody. Do not erase a returned computer until required data, legal holds, and security evidence have been addressed. After approval, IT can remove organizational data, release or retain device-management enrollment as appropriate, and prepare the device for reassignment. Personal devices should receive only the organization’s approved selective wipe where supported; do not erase personal content.

Limits and escalation

Account deletion is not the same as retention. Cloud recovery periods are short, licensing changes can affect mailbox behavior, and third-party applications may retain or delete data on different schedules. Legal holds, regulated records, suspected theft, hostile departures, missing devices, or privileged administrators require immediate escalation to HR, Legal, and security.

Request written confirmation that sign-in was blocked, sessions were revoked, critical data was transferred, mail handling was configured, licenses were reclaimed when safe, and assets were returned or reported missing. If the employee leaves earlier than planned or retains access after the cutoff, call the service desk or security contact immediately rather than waiting for the ticket queue.