Offboarding

Offboarding is Tools & Access run in reverse: walk every row, revoke every account. The table is the checklist, so nothing is missed.

flowchart TD
  A["Departure confirmed"] --> B["Knowledge transfer<br/>handover doc + walkthrough"]
  B --> C["Reassign open work items<br/>on the board"]
  C --> D["Revoke access<br/>walk every Tools table row"]
  D --> E["Rotate shared secrets<br/>in Key Vault"]
  E --> F["Return assets<br/>hardware + client materials"]
  F --> G["Confirm client handover<br/>tied to final payment"]
  G --> H["Deactivate identity / SSO"]

Revoke in this order

1. Knowledge transfer first — capture what only they know into a repo doc or runbook before access is gone.
2. Reassign work items so nothing stalls on the board.
3. Revoke access row by row down the Tools & Access table — Azure DevOps, repos, Key Vault, pipelines, app stores, client systems, SaaS.
4. Rotate any secret they could have seen in Key Vault — treat shared exposure as compromise.
5. Return assets — hardware, and any client-owned materials.
6. Deactivate identity / SSO last — it’s the master key; pulling it early can block the earlier steps.

Client handover

• Code and credential handover to a client is tied to final payment — don’t release before it clears.
• After handover we hold no client credentials; the client-owned rows in the table go to zero.

Caution

Identity / SSO is deactivated last. Revoking individual tools first keeps an audit trail; killing SSO first can strand access you can no longer see to revoke.

Because every account traces to a row in Tools & Access, an untracked account is the one you’ll forget — which is why that table must stay current.

← Related: Tools & Access