Onboarding and Offboarding: Getting Day One and the Last Day Right

Why do onboarding and offboarding go wrong?

At most growing companies, onboarding and offboarding happen often enough to matter and rarely enough that nobody owns them. Someone sets up a laptop by hand, buys one online the week before a start date and creates accounts from memory. When someone leaves, a few accounts get turned off and a few get missed.

The result shows up in familiar ways: a new hire spends their first morning waiting for a password, a shared login keeps working long after the person who knew it has gone, or a key vendor account is still tied to a former employee's email address.

None of this calls for expensive software. It calls for a repeatable process with a clear trigger.

Who should trigger onboarding and offboarding?

The trigger should come from HR or the hiring manager, not from IT noticing someone new in the hallway. A single, simple request form works well. It should capture:

• Name, role, department and manager
• Start date or last day, including the exact time access should end
• Which apps, shared drives and groups they need (or a role template that covers it)
• Device needs, and where to ship or hand off equipment
• For departures: who receives their email, files and any accounts in their name

Asking for onboarding requests at least a week ahead gives time to order, set up and ship a device. Offboarding requests should come as soon as a departure is known, even if the details are confidential, so the timing can be planned quietly.

What should be ready on a new hire's first day?

• A company laptop that's managed, encrypted and updated, with standard apps installed
• Email and Microsoft 365 or Google Workspace account created, with the right licenses
• Multi-factor sign-in (MFA) set up, or a clear first-morning step to set it up
• Access to the right shared drives, channels, groups and distribution lists
• Accounts in role-specific apps such as CRM, accounting or project tools
• Phone or softphone extension, if your business uses one
• A short welcome note: how to get IT help, how to sign in and basic security expectations
• Security awareness training scheduled for the first week

Stop setting up laptops by hand

Manually setting up each laptop is slow and inconsistent. Modern device management lets a new computer configure itself when the employee signs in for the first time: settings, security tools and apps all install automatically. Apple and Microsoft both offer this kind of zero-touch setup, so a laptop can ship straight to someone's home and be ready when they open it.

It works best when devices are bought through business channels rather than consumer retail sites, so they can be registered to your company from the start. Standardizing on a small number of models also makes setup, support and replacement simpler. For the buying side, see buy, lease or rent: choosing laptops for a growing team.

What should happen on an employee's last day?

• Disable sign-in to email and Microsoft 365 or Google Workspace at the agreed time
• Sign the person out of all active sessions and reset or remove MFA methods
• Remove access to shared drives, apps, VPN and remote access tools
• Change passwords for any shared accounts the person knew
• Convert their mailbox to a shared mailbox or forward it to their manager, so client email isn't lost
• Transfer ownership of files, shared folders and calendars
• Move any business accounts registered in their name, such as vendor portals, domains or ad accounts, to a company-owned address
• Recover laptops, phones, keys and badges, and update door access
• Remove their device from company management after retrieval, then securely wipe it before reuse
• Remove licenses so you stop paying for them

How single sign-on makes offboarding safer

Single sign-on (SSO) means people sign in to many business apps using their main company account. When that one account is turned off, access to every connected app ends with it. That turns a long list of manual steps into one action, and it closes the gap where a forgotten app keeps working.

Not every app supports SSO, and some need a higher subscription tier to use it. It's still worth connecting the ones that do, starting with the apps that hold the most sensitive data.

Shared logins and role changes

Shared logins are the hardest thing to offboard, because nobody can be sure who knows the password. Wherever possible, give people their own accounts. When a shared account is unavoidable, keep the credentials in a company password manager so they can be changed in one place.

Role changes deserve the same care as departures. When someone moves from sales to operations, remove the access they no longer need and hand off any shared mailboxes they managed. Access tends to pile up quietly otherwise.

What about sensitive departures?

Some departures carry more weight, like an engineer with access to source code or a leader with access to financial systems. For those, plan the timing with HR and leadership in advance, so access ends at the moment the conversation happens, not after.

IT can preserve mailboxes, files and activity records so they're available later if needed. Questions about ownership of work product, intellectual property or what a departing employee is permitted to keep belong with your attorney.

How fast should access be removed?

The same day, at the agreed time. With our clients, departing employees lose access the same day, and devices are recovered and wiped as part of the same process. Onboarding and offboarding are built into our onboarding and offboarding service, with requests coming straight from HR or managers.

Contractors and personal devices add their own wrinkles. See personal devices and contractors: what to manage, and what to leave alone.

Where to start

Pick your next hire or departure and write down every step it takes today. The gaps usually become obvious quickly. If you'd like help turning that into a repeatable process, book a 15-minute call and we'll walk through how it would work for your team.