IT Onboarding and Offboarding Checklist for Miami Businesses

An IT onboarding and offboarding checklist really is one short list used twice: accounts, devices, access and data. What changes is the intent. Onboarding builds a working identity for a new hire so they can do their job on day one. Offboarding is a security event, and anything left open on someone's last day is still open a year later. Most small businesses handle the first day with care and let the last day happen in a rush, which is backwards from a risk standpoint. One active mailbox, one stale group membership, or one shared password nobody rotated can outlive the employment relationship by years.

Why offboarding deserves more attention than onboarding

An onboarding mistake is visible. The new hire cannot sign in, someone fixes it within the hour, and the whole office knows because it is the first day. An offboarding mistake is invisible. Nobody notices that a departed employee can still read the shared inbox, still sits in the accounting group, and still has a personal phone with their work email configured on it. Nothing looks wrong, so nothing gets checked. That is precisely what makes it the more dangerous of the two.

There is also a human factor. Offboarding usually lands on the same week as a resignation, a termination, or a role change, which means it competes with covering the work, calming the team, and answering clients. Under that pressure, the steps that are easy to forget are the ones nobody can see. The account gets disabled, everyone feels done, and the other six things on the list quietly do not happen.

Day one for a new hire: what must exist before they sit down

The goal is that the person walks in, signs in, and starts working. Every item below should exist before their first morning, not be assembled while they wait at reception.

• A named user account, created for the person and never shared, with the correct role and department recorded in a directory
• A licensed mailbox with the correct display name, job title, and signature, plus the phone number and extension listed where clients can find it
• Multi-factor authentication enrolled on the device they will actually carry, at enrollment time, not after the first suspicious login
• A managed device that is encrypted, patched, and enrolled in your device management before it leaves the office
• File access scoped to what the role needs: the right shared drives, the right folders, the right document libraries, and nothing inherited by accident from a previous holder of the job
• Any phone system seat, softphone account, or call routing change, including voicemail to email if the role needs it
• A password manager entry or invitation so the person has one place for credentials instead of a notebook or a browser profile
• A short written record of what was granted, on what date, and by whom

That last item is the one almost everyone skips, and it is the one that makes offboarding possible. If nobody wrote down what was granted, nobody can reliably remove it.

Week one: what gets built after they start

Day one gets the person working. Week one keeps them from becoming the weakest link, and it is where most small businesses have the least structure.

• Security awareness training that covers the specific attacks their role will see, not a generic video from a compliance catalog
• A clear, low-friction way to report a suspicious email, with an explicit promise that reporting will never be treated as a mistake
• Confirmation that their work is landing in a backed up location, which almost always means the shared drive or cloud storage rather than the desktop
• A named person and number to call when something breaks, written down and not left to be discovered
• A brief walkthrough of what they should never do: share a login, approve an MFA prompt they did not trigger, or move company data onto a personal account

This is also where a managed plan does more work than a one-time setup. Business Protect includes annual employee cybersecurity training with certificates for each person, which gives you both the habit and the documentation, plus a quarterly technology and security review where the account list and its permissions get looked at on a schedule rather than during a crisis.

The offboarding sequence: step by step

Order matters here. Doing these in the wrong sequence is how data gets lost or how a departing employee retains access while you are still gathering information. Also, and this is the step people skip most often: check what the account owns before you delete it.

1. 1Disable the account first and delete it later. Disabling stops sign-in immediately while preserving the mailbox, files, and audit trail for the handover. Deletion is a separate decision made after the data has been dealt with.
2. 2Revoke active sessions and refresh tokens. A disabled account with a live session on a phone or laptop can keep working until that session expires. Force the sign-out explicitly.
3. 3Forward or archive the mail according to your policy, and set an out-of-office reply naming who to contact instead. Decide up front whether the mailbox becomes a shared mailbox, gets delegated to a manager, or is exported and archived.
4. 4Recover devices, then wipe them. Get the laptop, phone, tablet, and any accessories back, remove the device from management, and wipe it before it is reissued. Do not reissue a device that still holds a previous user's profile.
5. 5Transfer file ownership. Anything sitting in a personal OneDrive, a local folder, or a draft in an email thread needs an owner who is still employed. Losing access to the only copy of a client file is a business problem, not just an IT one.
6. 6Remove the person from groups, distribution lists, shared drives, and channel memberships. Group membership is where access quietly persists, and nested groups are the usual hiding place.
7. 7Change every shared password the person could have seen. Shared logins, vendor portals, alarm codes, and the wifi password if it is written down anywhere. This is a rotation event, not a judgment call about trust.
8. 8Notify vendors, banks, and key clients where the person was a named contact or an authorized user. Include any service that lists them as an admin or billing contact.
9. 9Update the phone system: remove the extension, change the voicemail greeting, and reroute calls to whoever is covering the role.
10. 10Record what was completed, with dates, and keep it. It is the only way to answer the question later about whether access was actually removed.

The access that quietly survives a departure

These are the specific items that turn up again and again when we review a business that believed offboarding was complete. None of them show up in a normal sign-in log as an obvious problem.

• Shared logins: a generic account like info@ or billing@ that several people know the password to. Disabling the individual's account does nothing, because the shared account is the one that was used.
• Contractor and vendor accounts: created for a project, never given an end date, and still active two years later. Every external account needs an owner and an expiry.
• Personal devices with mail configured: a phone or tablet that was never in your device management but holds a live mailbox. If the session is not revoked, the mail keeps arriving.
• MFA devices tied to the old phone: the authenticator app or the phone number that no longer belongs to the employee. Worse, an MFA method that should have been removed but is still an approved factor on a shared or reassigned account.
• App-specific passwords: legacy credentials generated for a mail client or integration that bypass the normal sign-in entirely and survive a password reset.
• Mailbox rules and forwarding: a forwarding rule or inbox rule created before departure that continues to send mail elsewhere. These are also a favorite of attackers, which is why they should be reviewed on every high-value account.
• Browser and cloud sessions on a reissued device: a returned laptop that was signed out rather than wiped can still hold cached credentials and synced profiles.

Who owns this when there is no IT department

For most small businesses the honest answer is nobody, which is why the list stops halfway. The fix is not hiring an IT person. It is naming one accountable human and giving them the checklist, the access, and the authority to say no.

• Name one owner for onboarding and one for offboarding, even if both are the same office manager. Accountability that is shared across a team is usually accountability that is shared by nobody.
• Separate the decision from the execution. A manager approves the access; the owner executes it. This is what stops a rushed Friday afternoon from turning into an open door.
• Give the owner real access to the systems, or a working relationship with whoever does. A checklist someone cannot act on is a document, not a control.
• Involve the person who knows the job, not just the person who knows the systems. Only the manager knows which client files and which shared inboxes actually matter for the role.

How to make it repeatable

A checklist that lives in someone's head is not a process. It works until that person is on vacation, and then it fails exactly when it matters. Three habits turn the list into something that survives staff changes.

1. 1Write the checklist down, one shared version, with the steps in order and the owner named beside each one. Two pages is plenty. Update it the first time a step turns out to be missing instead of arguing about it.
2. 2Open one ticket per employee, not one per task. A single record that shows what was granted and what was removed, with dates, is the only reliable answer to a request from an auditor, an insurer, or a client doing a vendor review.
3. 3Review active accounts and MFA devices on a schedule. Monthly for the account list and the administrator roles, quarterly for MFA methods and external or contractor access. The stale accounts you find in that review are the ones no offboarding process ever touched, usually because the person was never formally onboarded.

That scheduled review is also where backup and recovery fit. Premium Secure includes an annual external penetration test within an agreed scope and an annual backup restore test, which are the two checks that prove your documentation matches reality. If a departed employee's files were never transferred and the restore from backup does not actually work, the written process says one thing and the business is in a different position entirely.

Where this fits with the rest of your IT

Onboarding and offboarding are small, repetitive, unglamorous tasks that sit at the intersection of account administration, device management, and security. That is exactly the kind of work that gets dropped when everyone is busy, and exactly the kind of work a managed plan exists to absorb.

On our side, standard onboarding covers the account, the mailbox, the MFA enrollment, the device, and the permissions, with a record of what was granted. Offboarding runs the full sequence rather than just the sign-in block. All three plans are priced per user per month, month to month with no long-term contract, and the difference between them is depth rather than whether the basics are covered: Essential Care, Business Protect, which is the plan most of our clients choose, and Premium Secure.

If you want a second opinion on how much of this you are paying for today, our article on what managed IT actually costs breaks down what each tier covers and where the money usually goes. And if the concern behind the question is security rather than process, our small business cybersecurity guide covers the controls that matter most: multi factor authentication everywhere, a backup you have actually restored, and no remote access left open to the internet.

Simple Network Solutions has provided managed IT and cybersecurity to South Florida businesses since 2006, with a 5.0 Google rating from 18 verified reviews as of October 2026. We work across Miami including Brickell, Doral, Coral Gables and Wynwood, and support clients in English and Spanish.