employee-offboarding-it

name	employee-offboarding-it
enabled	true
description	Use when performing employee offboarding it — iT offboarding workflow for departing employees covering access revocation, device collection, data handling, license reclamation, and compliance documentation. Ensures all IT access is properly removed, company assets are returned, and data retention policies are followed during employee separation.
required_connections	[{"prefix":"itsm","label":"ITSM Tool (ServiceNow, Freshservice, etc.)"}]
config_fields	[{"key":"employee_name","label":"Departing Employee Name","required":true,"placeholder":"e.g., Jane Smith"},{"key":"department","label":"Department","required":true,"placeholder":"e.g., Engineering, Marketing, Sales"},{"key":"last_day","label":"Last Working Day","required":true,"placeholder":"e.g., 2026-04-15"},{"key":"manager_name","label":"Manager Name","required":true,"placeholder":"e.g., John Doe"},{"key":"separation_type","label":"Separation Type (voluntary/involuntary)","required":false,"placeholder":"e.g., voluntary, involuntary, contract end"}]
features	["HELPDESK"]

Employee IT Offboarding Workflow

IT offboarding for {{ employee_name }} ({{ department }}) Last Day: {{ last_day }} | Manager: {{ manager_name }} | Type: {{ separation_type }}

Phase 1 — Pre-Departure (3-5 business days before last day)

Access Audit

• Inventory all systems and applications {{ employee_name }} has access to
• Document all group memberships and role assignments
• Identify any shared accounts or service accounts managed by the employee
• Check for any API keys, tokens, or secrets created by the employee
• Review file shares and cloud storage permissions

Data Handling

• Coordinate with {{ manager_name }} on data transfer requirements
• Identify critical files that need to be transferred to a colleague
• Back up email mailbox per retention policy
• Back up personal drive / OneDrive / Google Drive per retention policy
• Document any knowledge transfer requirements

Device Planning

• Identify all company devices assigned to {{ employee_name }}
• Schedule device return (in-person or shipping label for remote)
• Prepare device wipe checklist

Phase 2 — Last Day (end of business on {{ last_day }})

Immediate Access Revocation

• Disable Active Directory / identity provider account
• Revoke SSO access (all connected applications disabled automatically)
• Disable email account (convert to shared mailbox if needed)
• Revoke VPN access
• Remove from MFA/2FA
• Disable remote access tools
• Revoke badge/physical access (coordinate with facilities)

Application-Specific Revocation

• Remove from Slack / Teams / collaboration platforms
• Revoke access to source code repositories (GitHub, GitLab, Bitbucket)
• Remove from cloud console access (AWS, Azure, GCP)
• Revoke ITSM portal access
• Remove from SaaS applications not covered by SSO
• Revoke any delegated admin permissions

Communication

• Set up email auto-reply / forwarding (per policy, max 30 days)
• Update voicemail greeting if applicable
• Remove from email distribution lists

Phase 3 — Post-Departure (within 5 business days)

Device Processing

• Collect all company devices (laptop, phone, tablet, peripherals)
• Verify device encryption status before wipe
• Perform secure data wipe on all returned devices
• Update asset management records (return to inventory)
• Reclaim software licenses from device

License Reclamation

• Reclaim all named-user software licenses
• Deactivate license seats for SaaS tools
• Update license count in asset management

Compliance & Documentation

• Confirm all access has been revoked (audit log review)
• Document offboarding completion in ITSM
• File offboarding checklist for compliance records
• Notify {{ manager_name }} of completion
• Close offboarding ticket

Counter-Rationalizations

Shortcut	Counter	Why
"We can skip some steps for this case"	Adapt the workflow steps, don't skip them	Skipped steps are where incidents and oversights originate
"The user seems to already know what to do"	Complete all workflow phases with the user	The workflow catches blind spots that experience alone misses
"This is a minor case, full process is overkill"	Scale the process down, don't turn it off	Minor cases become major when unstructured; the process scales, not disappears
"I'll fill in the details later"	Complete each section before moving on	Deferred details are forgotten; real-time capture is more accurate
"The template output isn't necessary"	Always produce the structured output format	Structured output enables comparison, audit trails, and handoff to other teams

Output Format

Generate a tracked offboarding report with:

1. Summary with employee details and completion status
2. Access revocation checklist with timestamps
3. Asset return status with device details
4. Compliance sign-off confirmation