Offboarding employees: The ultimate checklist

With over 100 SaaS apps in the modern workplace, offboarding a departing employee is a long, complex process. Beyond retrieving laptops and badges, accounts in multiple apps must be deprovisioned fast. Ownership of shared resources need to be transferred to managers so critical data isn’t lost. Access to infrastructure and other systems has to be revoked. The list goes on and on.

At BetterCloud, we have helped thousands of customers automate their offboarding processes—giving them back 91% of their time. After offboarding over one million employees, we decided to compile a thorough, 14-step checklist for IT teams. Our best practices will make sure that every departing employee is fully offboarded, every time, in minutes. 

Our checklist even shows you how to create a zero-touch automated offboarding process that can be started with a ticket submission or a form fill. This way, anyone (including HR, managers, or IT) can kick off the automated offboarding process to ensure access is revoked quickly—before a departing employee can take any potentially harmful or costly actions.

Below we’ll share some excerpts from our Ultimate Employee Offboarding Checklist, so you can preview the best practices and recommended steps for offboarding employees.

What is the most efficient, complete, and secure way to offboard employees?

The easiest way to make sure departing employees are completely offboarded every time is by automating the process with a SaaS management platform (SMP) like BetterCloud. From a single platform, IT admins can easily create, customize, and update offboarding workflows that perform every step of the process in minutes. While other solutions may offer to automate offboarding, BetterCloud is designed to ensure anyone in your IT organization can easily build and update workflows.

Preparing to automate your offboarding process 

Getting ready to automate an offboarding process with an SMP like BetterCloud requires some upfront collaboration with your company’s HR/People team. You should set aside some time to thoroughly answer these questions to ensure you have all the details you need in one place. This will help get your offboarding workflow up and running fast.

1. Where are all the possible places that employees might store data?
   In many companies, many employees store their data in Google Drive. By taking a closer look, you might find critical documents and data in applications such as Dropbox, Microsoft 365, or even Zoom (for recordings).
   
2. What is your source of truth?
   Where does your company keep up to date HR data on employees? Is it an HRIS or an IdP like Okta, OneLogin, or Azure AD? Status changes in your source of truth can be used to start your offboarding workflow. Alternatively, you could integrate BetterCloud with an ITSM to use a ticket or form submission to kick off an automated offboarding workflow.
   
3. How do HR and managers want to handle things like delegation, auto-replies, and email forwarding?
   Do managers need to be granted email access to their departing employees? Should ownership be transferred for documents, calendar events, or other resources? Make sure you meet with these stakeholders to document a regular, repeatable process for every employee. Workflows can be customized to accommodate many different actions across different apps, depending on what works best for both HR and IT. What other gaps need to be considered?
   
4. What is your desired time period for deprovisioning licenses?
   Do you want to keep email access for 30 days? What data retention requirements do you need to accommodate?
   

Creating an automated offboarding workflow

Once you have spent time with HR, managers, and other stakeholders to map out your process, you’re ready to start building an automated offboarding workflow. We’ve included a number of possible actions you can take in some of the most popular apps in use today. Your own offboarding workflows can and should involve more apps to make sure each departing employee is fully offboarded. BetterCloud currently integrates with over 70 apps, and has over 1,000 actions you could add to your workflows.  

Step 1: Initiate Offboarding

If an HRIS like Workday, Greenhouse, or Bamboo HR is your source of truth, you can create an alert in BetterCloud to let you know whenever an employee has become inactive. Then, you can set your offboarding workflow to start any time that alert is triggered. You can also integrate with an ITSM like Jira or ServiceNow, or even a Google Form, to kick off your offboarding workflow as soon as a ticket or form is submitted. In both of these scenarios, no one in IT has to manually start these “zero-touch” offboarding workflows.

Alternatively, you can still have fast, efficient offboarding with a “one-touch” workflow, and set your workflow to begin when IT adds a user to a new organizational unit or group if Google Workspace, Okta, or Azure is your source of truth.

Possible zero-touch workflow triggers in BetterCloud:

• Workday: Alert Triggered: User Status Changes to Inactive exceeds its threshold
• Jira ServiceDesk: Offboarding Ticket

Possible one-touch workflow triggers in BetterCloud:

• Google: Any user is suspended
• Azure: Alert Triggered: User Added to Group exceeds its threshold
• Microsoft 365: Alert Triggered: User is Disabled exceeds its threshold
• Okta: Alert Triggered: User Added to Group exceeds its threshold (and Group is Offboarding)

Even better, you can add “IF” conditions to these triggers, in case you have separate offboarding workflows for employees in different departments. For example, if you set an “IF” condition to “User Department is Sales,” then the workflow would only run if the employee was part of the sales department.

Step 2: Lock and Retrieve Devices

The very next step in offboarding should be to remotely lock devices before retrieval. This will keep departing employees from using work laptops to cause harm, like deleting files or sharing proprietary information. We can add actions in Jamf, Workspace ONE, or Microsoft 365 to lock the users out of their devices quickly, depending on if you deploy Macs, PCs, or a combination of both. Then, we can have the workflow email the users with return instructions, as well as notify IT to retrieve the device.

Recommended workflow actions in BetterCloud:

• Jamf: Lock device
• Microsoft 365: Disable user
• VMWare Workspace ONE: Lock user devices
• Google and Microsoft 365: Send an email

As you can see from just the first two steps above, completely offboarding an employee can include a lot of steps. Our Ultimate Checklist for Offboarding Employees includes steps 3-14, additional tips and advice, and a look at what can happen if employees aren’t offboarded quickly enough.