SaaS Access Offboarding Checklist Template

The leaver type on the first task decides whether Phase 2 appears and whether the admin tasks in Phase 5 appear.

• Record the leaver, the last working day and the leaver type — Standard, Admin or privileged, or Hostile or urgent
• Name the SaaS owner, the data recipient and the finance contact — the data recipient is usually the leaver’s manager or successor
• Link the IT offboarding record for the same leaver — the identity provider disable, device return and HR steps run there, not here
• Agree the timing with HR — a standard leaver keeps access until the last day; a hostile exit loses it during the conversation
• Set the rule for this run: suspend or deactivate first, delete last — deleted accounts often take their files, calendars and history with them

Tasks appear only when the leaver type is Hostile or urgent. They run at the agreed minute, before the full inventory.

• Revoke refresh tokens and sessions at the identity provider — in Entra ID, Revoke-MgUserSignInSession; access tokens already issued keep working until they expire, typically about an hour
• Revoke the leaver’s OAuth tokens and app passwords in Google Workspace — the user’s security page lists connected applications and app passwords
• Revoke tokens in source control and cloud consoles — GitHub organisation owners can revoke fine-grained tokens under Active tokens, filtered by owner
• Suspend the leaver in the password manager — suspending keeps the vault recoverable; removing it can delete their items for good
• Take the leaver off billing, DNS, payment and social media admin roles — the apps outside SSO where one person often holds the only login

Each app found becomes a row in the app table on the last task.

• Export the apps assigned to the leaver in the identity provider — direct and group assignments in Entra ID, Okta or Google Workspace
• Pull 90 days of the leaver’s SSO sign-in events — they show which apps were used, not just assigned
• Search expense claims and card statements for SaaS charges — tools bought on a personal or team card never touch SSO
• List the third-party apps the leaver granted OAuth access — a grant to a note-taker or AI assistant can keep reading mail and files
• Ask the manager which tools only the leaver used — one-person tools are the ones with no second admin
• Record each app in the table — app, SSO or not, account action, new data owner and licence reclaimed

• Deprovision SCIM-connected apps from the identity provider — Entra ID provisioning runs about every 40 minutes, so check each app instead of assuming
• Confirm the app account is deactivated, not just unassigned — Okta deactivates the downstream account rather than deleting it, and some apps still bill a deactivated seat
• Disable local logins on apps that also use SSO — password fallbacks and accounts created before SSO was enforced
• Deactivate accounts by hand in apps outside SSO — in each admin console, with the date recorded against the app row
• Freeze first where an app blocks deactivation — Salesforce will not deactivate a default lead or case owner; freeze, reassign, then deactivate
• Remove the leaver’s guest access in client and partner tenants — shared channels and client portals

The last two tasks appear when the leaver type is Admin or privileged, or Hostile or urgent.

• Revoke personal access tokens and API keys the leaver created — source control, Atlassian, CI, monitoring and cloud tools
• Move integrations that authenticate as the leaver to a service account — Slack legacy bot users stop working when the member who created them is deactivated
• Rotate every shared vault item the leaver could open and revoke their sharing links — 1Password advises assuming leavers copied shared passwords
• Transfer owner and super-admin roles to a named successor in each app — every app should keep at least two admins, neither of them the leaver
• Review each app’s admin audit log for the last 30 days — new admins, new API keys, bulk exports and changed SSO or MFA settings

The data recipient records Approved or Not approved on the last task. The checklist halts there, and no account is deleted until they decide.

• Transfer Google Drive and Looker Studio content before deleting the account — shared drive files already belong to the organisation
• Transfer secondary calendars and hand over meetings the leaver organised — Google now deletes an owner’s secondary calendars with the account; Exchange Online’s Remove-CalendarEvents needs the mailbox to still exist
• Confirm the manager can open the leaver’s OneDrive and set the retention period — 30 days by default, configurable up to 3,650
• Reassign CRM records, queues and tickets — Salesforce’s Mass Transfer tool moves accounts, leads and custom objects
• Reassign automations, recordings, canvases and channels — Power Automate flows, Zoom meetings and recordings, Slack canvases and lists
• Confirm the handover with the data recipient — Approved or Not approved, with anything missing listed

Answering Yes to “Did the leaver pay for any app?” shows the billing transfer task.

• Remove or reassign each licence and mark it in the app table — reuse the seat for the next joiner before buying another
• Reduce seat counts where the contract allows — many annual plans only shrink at renewal, so put the reduction against the renewal date
• Record whether the leaver paid for any app themselves — Yes or No, from the expense and card search in Phase 3
• Move billing ownership to a company account — billing contact, payment card and account owner email, then cancel or merge into the company plan
• Recheck seven days after the last day — no sign-ins in the identity provider logs and no active account in any app row
• Attach the evidence and sign off — exports, screenshots and provisioning logs for each app, approved by the SaaS owner