SaaS administration
A SaaS offboarding checklist that closes access the same day
A same-day offboarding sequence for small IT teams: inventory the accounts, revoke identity and sessions, move data ownership, recover licences, and verify the closure with evidence.
Start with repeatable IT work that has a clear owner, clear access limits, and a review cadence. Keep risky technical decisions with the manager or provider who owns the system.
Delegation playbook
On this pageJump to section
Offboarding fails quietly when an account stays active after the laptop is returned. The former employee may never sign in again, but the licence, the shared mailbox, and the recovery phone can remain in place for months. A same-day checklist gives the IT team a repeatable way to close access and prove it happened. The goal is not a dramatic lockdown, but a clean record that survives an audit and a busy Friday. Prepare the sequence before the departure, not on the morning it happens.
Inventory every account before the last day
Start with the identity provider and export the accounts tied to the departing person. Include the primary email, the single sign-on profile, the device accounts, and any local admin login used for support. Add the SaaS tools that sit outside single sign-on, because those are the ones that get missed. Store the export with the offboarding ticket so the reviewer can see the starting point. The list becomes the checklist that the rest of the process works through.
Ask the manager to confirm which shared mailboxes, aliases, and distribution lists the person monitored. A shared inbox is not a personal account, and deleting it can break a customer contact path. Record the delegate who will take over each shared resource before the last day. This turns a vague request to cover the inbox into a named handover. If nobody can name a delegate, the manager owns that gap until it is resolved.
Revoke identity and sessions first
Disable the primary account before removing individual application access. That single action usually blocks new sign-ins across connected tools and gives the team time to work through the rest. Then revoke active sessions and refresh tokens so a browser that is already open cannot continue. Record the time of each action, because the gap between disable and revoke is exactly what an auditor will ask about. A disabled account with a live session is still an open door.
Reset the password on any local account that cannot be disabled through the identity provider. Change the recovery email and phone number away from the former employee before the account is archived. Check the mobile device management console for enrolled phones and laptops that still hold corporate data. A remote wipe should be a written decision, not an automatic reflex, because it can destroy evidence or personal files. Record the decision and the person who approved it.
Move ownership of data and automation first
List the files, forms, workflows, and scheduled jobs that the person owned. Transfer each one to a named manager or a service account with a documented owner. Automation is easy to forget because it keeps running after the person leaves and fails weeks later. Check the last run time and the notification address for every scheduled job you find. A workflow that sends mail from a disabled mailbox is a silent failure waiting for a customer to notice.
Reassign calendar resources, meeting links, and external collaboration spaces that the person created. Remove the departing user from groups that grant access to finance, customer data, or production systems. Keep a copy of the access list as it looked before removal, since that is the evidence of what was closed. Do not delete the account until the manager confirms that no business record depends on it. Archive the mailbox according to policy rather than leaving it active.
Recover licences and clean up billing
Match every paid seat to the offboarding list before the next renewal. Some tools charge annually, so a seat that stays active for a month can cost a full year. Record the licence name, the seat count, and the effective date of the change. Ask the vendor whether the seat can be reassigned or must be cancelled, because the rules differ. A reassigned seat may save more money than a cancellation that triggers a minimum commitment.
Check for personal payment methods and trial accounts created outside the approved process. These shadow subscriptions rarely appear in the main invoice and often continue after the person leaves. Add a note to the vendor record so the next reviewer knows why the seat was removed. Finance should see the cancelled seats in the same monthly report as the active ones. The report should separate realised savings from savings that only begin at renewal.
Verify the closure with evidence
Verification means testing the account, not reading a confirmation page. Attempt a sign-in from a controlled browser and confirm that the identity provider rejects it. Check that the shared mailbox still receives mail and that the delegate can open it. Repeat the check for the two or three tools that hold the most sensitive data. Save the test result with a timestamp and the name of the person who performed it.
Save the timestamped result beside the offboarding ticket and name the person who performed the check. If a tool cannot be tested, record why and who accepted the residual risk. An untested tool is not a closed item, even when the admin panel shows a disabled user. The reviewer should be able to reconstruct the closure without asking the original engineer. A short verification note is worth more than a long assurance in chat.
Handle exceptions with a deadline
Sometimes a manager needs temporary access for a contractor or a transition period. Grant that access through a separate account with a scope, an expiry date, and a named approver. Never reactivate the departing employee's account as a shortcut. Put the expiry date on the team calendar and assign someone to remove it. The temporary account should be visible in the monthly access review like any other privileged identity.
Treat a missing manager approval as an exception, not a reason to leave access open. Escalate to the next approver in the chain and document the delay. If the business insists on continued access, record the risk acceptance and the review date. Exceptions should be visible in the monthly access report rather than buried in a ticket comment. The report should show how long each exception has been open and who is expected to close it.
Reconcile the process every month
Compare the HR departure list with the identity provider and the SaaS billing export. Any account without a matching active employee is a finding, even if it turns out to be a service account. Sample five closed offboardings and check that the evidence matches the checklist. Report the exceptions to the manager who owns the process. A monthly reconciliation catches the accounts that were missed on a busy Friday.
Update the checklist when a new tool joins the stack or a vendor changes its cancellation rules. Keep the owner's name on the document so it does not become an orphaned wiki page. Measure the time from departure to access removal and review the trend rather than a single case. A same-day target is realistic only when the steps are rehearsed. Run one practice offboarding per quarter with a test account so the team keeps the sequence fresh.
Sources and next step
Use the CISA Cross-Sector Cybersecurity Performance Goals and the NIST Cybersecurity Framework as primary references for identity, asset, logging, and recovery practices. Apply your own policies, contracts, and system documentation to the workflow. Compare this guide with the IT change request process and the remote helpdesk workflow before changing a live process.
Keep requests, approvals, and evidence in systems the business already controls. If the coordination is recurring and your technical owner can define the boundaries, review the IT virtual assistant service areas and contact ITVirtualAssistant to discuss a limited pilot.
Operating brief
What this guide should help you decide
Routine intake, status updates, records, screenshots, and documentation upkeep.
Approvals, risky system changes, security decisions, and final technical judgment.
How to use this guide
Use this page to decide what an IT virtual assistant should handle first. If the task is recurring, documented, and easy to review, it is usually a better first delegation candidate than work that requires live technical judgment.
Treat the article as an operating brief, not just a topic overview. The goal is to turn loose IT work into a named workflow with inputs, outputs, permissions, review cadence, and a handoff rule that protects the business while reducing manager load.
Workflow
Recommended operating workflow
Define the request
Write what a saas offboarding checklist that closes access the same day means in your company, where requests enter, and what finished work looks like.
Limit the access
Give the assistant only the tool permissions needed for intake, records, status updates, or documentation.
Run a pilot
Use a two-week sample period so the manager can review accuracy before expanding the workflow.
Review patterns
Summarize repeat issues, blocked requests, and escalation volume so the technical owner can improve the process.
Decision rules
| Question | VA fit signal | Escalate when |
|---|---|---|
| Is the work repeatable? | The same request appears weekly and can be described in steps. | The request changes business policy or system design. |
| Can quality be reviewed? | The manager can inspect the output without redoing the work. | Only a senior technical person can judge correctness. |
| Is access contained? | The assistant can work with read-only or role-limited access. | Admin rights, customer data, or security settings are involved. |
Delegation checklist
- Write the intake source, expected output, and manager review cadence.
- Confirm the assistant has only the permissions needed for the workflow.
- List the events that require escalation before work continues.
- Track examples for two weeks before changing the workflow.
- Save examples of good and bad outputs so the assistant has concrete references.
- Review the workflow monthly and remove permissions that are no longer needed.
Example first-week agenda
Day one should cover the workflow owner, tools, allowed actions, forbidden actions, and escalation language. By the end of week one, the assistant should have produced a small sample of completed work, a list of unclear requests, and a manager-reviewed improvement note.
What to review before delegating
Confirm the owner, access level, review cadence, and escalation path before assigning any recurring IT workflow to a remote assistant.
What should an IT virtual assistant handle first?
Start with repeatable, reviewable work such as ticket summaries, account records, documentation updates, and checklist follow up.
Get free IT support review