Little Milker · Offboarding Checklist Tracker

Identity & access

Disable AD / SSO account

Disable (do not delete yet) the identity in the primary directory and any federated SSO.
Revoke VPN / remote access

Remove from VPN groups and any client certs / MFA tokens.
Disable email mailbox

Convert to shared mailbox or set auto-reply per the manager's preference, then disable login.
Remove from security groups & DLs

Strip from any role-based AD groups and distribution lists they belonged to.
Revoke SaaS app access

Audit and remove from each SaaS tool (review SSO logs for the last 90 days to catch unmanaged apps).
Disable building access

Deactivate badge / keycard with physical security.

Transfer file ownership

Move ownership of shared drives, OneDrive/Google Drive folders, and team files to the manager or successor.
Archive email / chat history

Archive mailbox, set retention, capture chat history per retention policy.
Reassign owned tickets / projects

Reassign any open tickets, Jira issues, PRs, or oncall rotations.

Collect laptop / desktop

Coordinate return shipping for remote employees; wipe and re-image on receipt.
Collect peripherals & badge

Monitors, dock, headset, security key, badge — whatever was issued.
Recover MFA tokens

Hard token, YubiKey, or similar.
Mobile device — remove from MDM

If a corporate phone or BYOD with work profile, unenroll and wipe the work container.

Cancel corporate card

Notify finance to cancel the card and reconcile outstanding charges.
Close expense reports

Push manager to approve any pending reports before final paycheck.
Update vendor approvals

Remove from purchasing / approval workflows.

Notify the team

Send the agreed-upon internal note (with manager) and update org chart / directory.
Update external-facing contacts

Customers, partners, vendors whose primary contact was this person.
Forward / redirect phone

Forward direct line and update IVR if they were on a queue.