IT Onboarding and Offboarding Checklist for Small Teams

This checklist is for the one- to five-person IT team that handles every joiner, mover and leaver itself, usually with Active Directory or Microsoft Entra ID, a few Linux servers and a handful of SaaS apps. The short answer: drive both processes from a ticket, grant access only through role groups, record every device against the person in your asset register, and on the last day disable the account first, then revoke sessions, then clean up. The commands below come from the official Microsoft, Keycloak and FreeIPA documentation; adapt names and OUs to your own environment and run them in a test tenant or lab first.

The checklist at a glance

Onboarding: before the first day

1. Open a ticket from HR’s request. Record the start date, manager, job role and any equipment. The ticket is your audit trail; access granted without one is the first thing an auditor asks about.
2. Create the account disabled. Enable it on the morning of the first day, not when the paperwork arrives. In Active Directory:

   New-ADUser -Name "Jane Doe" -SamAccountName jdoe `
     -UserPrincipalName jdoe@corp.example `
     -Path "OU=Staff,DC=corp,DC=example" -Enabled $false
   Add-ADGroupMember -Identity "Finance-RW" -Members jdoe

3. Grant access through role groups only. A group such as “Finance-RW” is reviewable; a dozen direct permissions on a share are not. Copying another user’s groups is how leftover access spreads, so map the role to groups instead.
4. Set an expiry for contractors. Set-ADAccountExpiration puts an end date on the account, so a temporary account stops working even if nobody remembers the end date.
5. Linux and SSO. In FreeIPA, ipa user-add jdoe --first=Jane --last=Doe --email=jdoe@corp.example creates an active user. In Keycloak, the admin CLI does the same: kcadm.sh create users -r corp -s username=jdoe -s enabled=true.

Onboarding: day one

• Enable the account and have the person register MFA in front of you or over a verified call.
• Check out the laptop and phone to the person in the asset register. Snipe-IT is built around check-out and check-in of assets to users; GLPI links computers to users in its inventory. Either way, the register should answer “what does this person hold” in one search. Our IT asset management and help desk tools hub compares the options.
• Confirm the laptop shows up in inventory. Open-AudIT audits Windows over WMI and Linux over SSH, and its free edition covers up to 100 devices. If you document network ports and IP addresses, record the desk port or reserved address in NetBox as part of the same ticket.
• Assign SaaS apps through your identity provider where you can, and keep a short manual list for apps that have their own user database.

Movers: the step teams forget

When someone changes role, add the new groups and remove the old ones in the same ticket. People who move twice without cleanup end up with more access than anyone in either team. Export the before and after group list into the ticket:

Get-ADPrincipalGroupMembership jdoe | Select-Object Name

Offboarding: the last day, in order

Order matters. Disable first so no new sign-in can succeed, then cut existing sessions, then deal with data and devices.

1. Active Directory

Microsoft’s guidance for revoking access is to disable the account and reset the password, twice if there is any chance the account is compromised, to reduce the risk of pass-the-hash:

Disable-ADAccount -Identity jdoe
Set-ADAccountPassword -Identity jdoe -Reset `
  -NewPassword (Read-Host -AsSecureString "Random password")

2. Microsoft Entra ID

In the Entra admin center, open the user, clear Account enabled and then select Revoke sessions. With Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
$User = Get-MgUser -Search UserPrincipalName:'jdoe@corp.example' -ConsistencyLevel eventual
Update-MgUser -UserId $User.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $User.Id

Revoking does not end access instantly everywhere. Microsoft notes that access tokens last one hour by default, and apps that issue their own session cookies keep the user signed in until that session ends or the app deprovisions the user. That is why app deprovisioning is a separate step.

3. Keycloak and FreeIPA

In Keycloak, list the user’s sessions and log them out with kcadm.sh get users/<id>/sessions -r corp and kcadm.sh create users/<id>/logout -r corp -s realm=corp -s user=<id>, then set enabled=false on the user. In FreeIPA, ipa user-disable jdoe blocks logins, and ipa user-del --preserve jdoe moves the account to the preserved state: it cannot log in, keeps most attributes and is removed from all groups. ipa user-undel jdoe restores it if HR reverses the decision.

4. Apps, data and devices

• Remove the user from every app, starting with those that are not behind SSO and have their own passwords.
• For Exchange Online, a user mailbox can be converted to a shared mailbox in the Exchange admin center or with Set-Mailbox -Identity jdoe -Type Shared, so the manager keeps the mail. Check Microsoft’s current licensing rules for shared mailboxes before removing the licence.
• Transfer ownership of files and shared folders before any deletion is scheduled.
• Check the devices back in. If the person had local admin rights on a laptop that will be reused, run Reset-LapsPassword on that device; it makes Windows LAPS rotate the managed local account’s password immediately.
• Remove SSH keys and sudo rules on Linux servers. Configuration management keeps this honest: Rudder ships techniques for users, SSH and sudoers, and the Salt Minion for Windows manages local users on Windows hosts.

Evidence: prove it happened

Windows records account changes in the Security log when Audit User Account Management is enabled. The events worth collecting are 4720 (account created), 4722 (enabled), 4725 (disabled), 4726 (deleted) and 4738 (account changed). Forward them to a SIEM such as Wazuh (free, open source) so that a new account with no ticket, or a leaver who is still enabled, becomes an alert rather than an audit finding. Once a quarter, look for accounts that should not exist:

Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly
Search-ADAccount -AccountExpired -UsersOnly

If you want the whole sequence as a runbook rather than a document, StackStorm logs each execution with its inputs and the user who started it; our sysadmin automation tools hub covers the alternatives. For access reviews, LAPS and SSO in more depth, see the identity and access management tools hub.

Limitations

• This is a starting checklist, not legal or HR guidance. Retention periods for mail and files depend on your jurisdiction and contracts.
• Not tested yet: the commands are taken from vendor documentation, not from a lab run by us. Run them in a test environment first.
• Session revocation has limits. Apps with their own sessions or local accounts need their own deprovisioning step.
• Entra ID features differ by licence. Check which edition you have before relying on automated provisioning or access reviews.

FAQ

What should an IT offboarding checklist include?

At minimum: disable the directory account, reset the password, revoke sessions and tokens, remove the user from every app, transfer mailbox and file ownership, check devices back in, rotate any shared or local admin passwords the person knew, and close the ticket with evidence.

What is employee offboarding?

It is the process of removing a departing employee’s access and recovering company equipment and data. For IT, it is the leaver part of the joiner-mover-leaver lifecycle.

What does an IT onboarding checklist for new hires cover?

A ticket with the start date and role, an account created disabled, access through role groups, MFA registration on day one, devices checked out in the asset register and app assignments through SSO where possible.

Should I delete or disable a leaver’s account?

Disable first. Deleting removes the group history you may need for an audit and can orphan files. Delete later according to your retention policy; in FreeIPA, the preserved state exists for exactly this.

Is there an IT onboarding checklist template in Word or Excel?

Copy the table at the top of this page into a document or spreadsheet and add one row per app you run. A template only helps if it lists your real systems.

Last updated: 13 October 2026 · AdminHub Plus editorial team. Licence, version and platform details are checked against each developer's official documentation.