Onboarding and Offboarding Staff IT Access Properly

Staff starting and leaving a business is one of the most routine things that happens in any workplace, and yet it's consistently where IT access goes wrong — frustratingly slow and disorganised on the way in, and quietly forgotten (which is the riskier problem) on the way out.

Why onboarding often starts badly

A genuinely common pattern is a new starter's first day being partly wasted waiting for accounts, email, and software access to be set up, because the request to IT only went out a day or two before they arrived, or key details (what systems they need, what equipment they're using) weren't actually confirmed in advance.

A better approach to onboarding

The fix is usually just lead time and a simple checklist: know a new starter's start date and role requirements at least a few working days ahead, have a standard list of what each role typically needs access to, and get accounts, equipment, and licences set up before day one rather than reactively once they've already arrived.

Why offboarding is the bigger risk, not just the bigger inconvenience

A slow onboarding is annoying. A slow or incomplete offboarding is a genuine security risk — a departing employee (regardless of the circumstances of their leaving) retaining access to email, shared files, or business systems for days or weeks after they've gone is a real, if often overlooked, exposure.

What proper offboarding actually covers

• Disabling (not always immediately deleting, in case email or files need retaining) their account access on their actual last day, not whenever someone remembers to do it.
• Removing access to any shared mailboxes, cloud storage, or third-party tools they had logins for — not just their main company account.
• Recovering or wiping company devices, and removing company email and data from any personal devices used under a BYOD arrangement.
• Redirecting or forwarding their email appropriately so nothing important is lost, while access itself is removed.
• Reviewing and removing them from any shared passwords they had access to.

Make it a checklist, not a memory exercise

Both onboarding and offboarding work far better as a simple written checklist followed every time, rather than relying on whoever happens to be managing it that week remembering every step. It removes the inconsistency that causes most of the actual problems.

If you don't currently have a clear onboarding and offboarding process for IT access, or want help putting one together, our managed IT support page covers how we can help, or get in touch.