This free SaaS offboarding checklist covers the application layer of a departure. IT teams, security teams and MSPs run it alongside their main leaver process to find every app the person used, inside and outside single sign-on, then close each account, revoke tokens, rotate shared credentials, move data to a new owner, reclaim the licence and keep the evidence.
Blocking sign-in at the identity provider stops new logins to apps connected through SSO. It does nothing to a local password in an app outside SSO, a personal access token, an OAuth grant to a third-party tool or a billing account in the leaver’s name. Those need work in each app, and that work goes missing when one line on the leaver checklist says “remove from SaaS apps”.
Covers: identity provider disable, sessions, MFA, laptop return, building access.
Owner: IT, triggered by HR.
Done when: the directory account is blocked and the hardware is back.
Covers: each app the leaver used, its tokens, shared logins, data, licence and bill.
Owner: IT or the SaaS owner, with each app admin.
Done when: every app row is closed, transferred and reclaimed, with evidence.
Covers: stale accounts and access that should no longer exist.
Owner: IT and system owners, quarterly.
Done when: each account is kept, changed or removed and signed off.
The identity, device and HR steps live in CheckFlow’s IT offboarding checklist software and in the IT offboarding security guide, which sets the order for voluntary and involuntary exits. Accounts that survive a departure turn up in the Active Directory & Entra ID Account Cleanup Checklist and the quarterly User Access Review Checklist. This page goes app by app instead.
Seven phases take one leaver from inventory to evidence. The leaver type on the first task adds an urgent cut-off phase for a hostile or urgent exit and admin tasks for privileged leavers, and data is not deleted until the new owner confirms the handover.
The leaver type on the first task decides whether Phase 2 appears and whether the admin tasks in Phase 5 appear.
Tasks appear only when the leaver type is Hostile or urgent. They run at the agreed minute, before the full inventory.
Each app found becomes a row in the app table on the last task.
The last two tasks appear when the leaver type is Admin or privileged, or Hostile or urgent.
The data recipient records Approved or Not approved on the last task. The checklist halts there, and no account is deleted until they decide.
Answering Yes to “Did the leaver pay for any app?” shows the billing transfer task.
Most offboarding data loss comes from deleting an account before its content has a new owner. These steps come from each vendor’s admin documentation as of 6 October 2026; recheck before relying on a default.
| App | Before removing the account | What goes wrong if you skip it |
|---|---|---|
| Google Workspace | Transfer Drive, Looker Studio and calendar data; transfer secondary calendars and future events | From 5 October 2026, deleting an owner also deletes their secondary calendars, and they can no longer be transferred |
| Microsoft 365 | Give the manager OneDrive access; convert the mailbox to a shared mailbox if it must stay | OneDrive is deleted after the retention period, 30 days unless changed; an unlicensed shared mailbox is capped at 50 GB |
| Salesforce | Freeze the user, transfer records, then deactivate | Deactivation is blocked for default owners; a frozen user still holds a licence |
| Slack | Reassign canvases and lists; move bots and integrations to an active owner | Legacy bot users created by the leaver stop working on deactivation |
| GitHub | Reassign repository admin; review fine-grained tokens; remove from the organisation | Removed members lose private forks; access can be reinstated for three months, so record the removal |
| Zoom | Use Transfer Data Then Delete for meetings, webinars and cloud recordings | Personal Meeting ID meetings cannot be transferred; tell attendees of a new link |
| Power Automate | Change the owner of solution flows; add a co-owner or copy other flows | Flows that use the leaver’s connections fail once the account is disabled |
| 1Password | Ask the leaver to move work items, suspend the account, then rotate shared items | Removing a member permanently deletes items in their Employee vault |
Licence timing is the other trap. On a Google Workspace Annual/Fixed-Term Plan the payment stays the same until the contract renews; on the Flexible Plan the next monthly bill falls. Microsoft’s new commerce annual subscriptions only allow reductions within seven days of buying, renewing or adding licences. A leaver in March can free a seat you pay for until the anniversary, so reassign it to the next joiner and note the renewal date in the app table. Whether a seat deactivated by SCIM still counts towards the bill depends on the vendor, which is why each row records the licence outcome separately.
The inventory task holds a table with a row per app: SSO or not, account action, new data owner and licence reclaimed. A data set of your company’s apps, with admin and SSO status, keeps the list consistent between leavers.
A required dropdown on the first task records the leaver type. Hostile or urgent shows the cut-off phase; Admin or privileged shows the role transfer and audit log tasks. The Members picker assigns the SaaS owner, the data recipient and finance before any work starts.
The data recipient’s approval halts the checklist until files, records and automations have moved. Exports attach to the tasks they prove, the audit trail shows who closed each app and when, and tags keep each client separate for MSPs.
Run this checklist next to the main leaver process in CheckFlow’s IT offboarding checklist software, which handles the identity provider, devices and HR coordination. The IT offboarding security checklist explains why API keys and OAuth grants survive an account disable.
Seats freed here feed the next Software License Audit Checklist. Anything this run missed should surface in the quarterly User Access Review Checklist or Active Directory & Entra ID Account Cleanup Checklist.
No. It stops new sign-ins through SSO, and with SCIM it deactivates the account in connected apps on the next provisioning cycle. It does not touch local passwords, accounts in apps outside SSO, personal access tokens, API keys or OAuth grants, and access tokens already issued work until they expire.
Combine four sources: the leaver’s SSO sign-in history, expense claims and card statements, the OAuth grants on their account in Google Workspace or Entra ID, and the manager’s knowledge of tools only that person used. A discovery tool such as Defender for Cloud Apps Cloud Discovery adds apps seen in firewall, proxy or endpoint traffic.
In Google Workspace, a super admin can transfer Drive files, Looker Studio assets and calendar data to another user while deleting the account; if you skip it, those files go with the account. In Microsoft 365, deleting the user gives their manager access to the OneDrive by default, and the OneDrive is deleted when the retention period ends. That is 30 days unless an admin sets a longer value in the SharePoint admin center, up to 3,650 days.
You can unassign the licence straight away, but the bill may not fall. Google Workspace Annual/Fixed-Term Plans only reduce at renewal, and Microsoft’s new commerce annual subscriptions only allow reductions within seven days of a purchase or renewal. Monthly and flexible plans usually drop on the next invoice. Record the renewal date for each app so the reduction is made when the contract allows it.
Deactivate or suspend first, then delete once the data has a new owner and any legal hold question is settled. Some apps do not allow deletion at all: Salesforce users can only be deactivated. Deleting early is how shared calendars, recordings and automations get lost, which is why this checklist halts for the data recipient’s approval first.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
