A departure becomes difficult when nobody can explain what the person could access. The missing information usually predates the resignation: an application purchased outside the normal process, a shared password, or project records kept in a personal workspace. Offboarding exposes those gaps; it does not create them.
Keep the first day connected to the last
A living access record makes a later handover less dependent on memory.
RDA treats joining, changing roles, and leaving as connected work. The aim is a record that another authorized person can follow without relying on the departing employee to remember every arrangement.
Start with an authorized identity
A manager should identify the role, required applications, start date, and information the employee needs. IT then creates the person in the organization's identity source, whether that is Active Directory, a suitable LDAP directory, a cloud directory, or a supported combination. The onboarding process explains that first dependency.
Create named access wherever the application supports it. Record approvals and group memberships rather than copying everything from a convenient colleague. Two people with similar job titles may have different responsibilities, and copying access can also copy old exceptions.
Directory access is only part of the picture. Identify applications with separate local accounts, external portals, phone services, and physical access. Single sign-on helps centralize access, but it does not promise that disabling one account instantly clears every application session or downloaded file. Each application's removal behavior needs to be understood.
Give the work a home that survives the employee
Before handing over a laptop, confirm who owns it, how it is managed, and where business files belong. If a personal device is approved, record the permitted work and the limits of data removal. A temporary arrangement needs an end date and someone responsible for closing it.
Shared work should have shared organizational ownership. A team library, authorized business application, or properly delegated mailbox is easier to hand over than records stored only in one person's account. Our file collaboration guidance covers that choice without assuming everything must move to the same platform.
Keep a short access record as the job changes. Add a new application when it is approved, and remove an old role when the work ends. Waiting until departure turns a routine update into detective work.
Rehearse the last day while there is time
For an existing employee, ask a simple question: could someone else carry out an authorized departure tomorrow? They should be able to locate the device record, application owners, account list, and retention decisions. Missing items become assigned work, not a reason to demand the employee's passwords.
Microsoft's former-employee guidance separates preventing access, preserving needed information, handling devices, and managing licenses. That is a useful reminder that account deletion alone is not a complete departure.
HR or the authorized manager supplies the timing. Records owners decide what must be preserved. IT executes and verifies the offboarding steps, including systems outside the main directory. A manager then accepts the business handover. Keeping those responsibilities clear makes both the first day and the last day less dependent on memory.