All checklists
Starters and leavers
Most onboarding problems aren't technical. They're timing: nobody told IT until the morning someone started. This checklist works backwards from the start date, and forwards from the resignation, so nothing gets remembered a fortnight late.
People and access14 stepsUpdated 30 July 2026
Who this is for
Office managers, HR and operations leads who handle joiners and leavers without a dedicated IT team.
Time needed: An afternoon to set up, 20 minutes per person after that
01
A week before day one
The jobs that need lead time.
- Confirm the start date, role and manager in writingAccess should be copied from a role, not from whoever sits nearest.
- Order the laptop or reassign a returned oneAllow for delivery and enrolment - a device that lands on the morning rarely gets set up in time.
- Buy or reassign the right licenceCheck whether a leaver's licence is free before adding another to the bill.
- Ask which systems the role needs beyond emailFinance, CRM, line-of-business apps and any shared mailboxes.
02
Day one
What has to be working before they sit down.
- Account created with multi-factor authentication enforcedSet it up with them on day one rather than chasing it later.
- Laptop enrolled, encrypted and signed inEncryption and remote wipe matter most on the devices you forget about.
- Group memberships applied, not individual permissionsPer-person access is what makes offboarding messy years later.
- Shared drives, mailboxes and Teams addedOnly the ones the role needs - a tidy start is easier than a clean-up.
- Show them how to report an IT problemPeople who don't know the route ask a colleague and the issue never gets logged.
03
The day someone leaves
Fast, in this order.
- Disable the account and revoke active sessionsChanging the password alone leaves signed-in phones and browsers working.
- Convert the mailbox rather than deleting itKeep access to the history and free the licence at the same time.
- Reassign file ownership and any personal drivesWork saved in someone's own storage disappears with them.
- Collect devices and confirm they're wipedRecord the return - unaccounted laptops turn up in audits, not cupboards.
- Remove them from third-party systems and shared loginsBanking, CRM, social accounts and anything with a shared password.
Worth watching out for
- Shared logins are the most commonly missed item on a leaver's last day - if a password was known by more than one person, change it.
- Licences quietly renew on leavers. Check the count against your headcount once a quarter.
- Personal phones with work email still hold company data after someone leaves unless access is revoked centrally.
Stuck on one of these steps?
Get an IT health check that reviews your support, security and Microsoft setup, then gives you a short, prioritised list of what's worth doing.