how to offboard a contractor completely
Complete contractor offboarding checklist covering accounts, access, equipment, and data. Use at every contractor end date. Not for employee offboarding (broader process).
TL;DR
Disable the contractor account (expiry should do this automatically; verify), revoke all access from the inventory list, collect equipment, remove from chats and repos, and confirm with the sponsor. The contractor checklist is shorter than employee offboarding but the verification matters more because contractors are often forgotten.
The error
(Offboarding; no error. Contractor end date reached.)Steps
- Verify the account is disabled: check AD/Entra for the expiry-triggered disable. Expected: disabled. Do not trust the expiry blindly; confirm it.
- Revoke access per the contractor's access inventory: VPN group, app assignments, repo access, cloud consoles, shared drives. Expected: each confirmed removed.
- Revoke sessions and tokens in the IdP. Expected: sessions killed.
- Collect equipment: laptop, badge, tokens. Expected: returned or remote wipe issued. Update inventory.
- Remove from team chats, channels, and mailing lists. Expected: removed. Lingering chat membership leaks information long after access is gone. Confirm with the sponsor that nothing is missed.
When to use
- Contractor end of engagement
- Early termination of a contractor
When not to use
- Employee offboarding
- Contractor extension (update the end date instead)
Compatibility
- Any identity and ITSM stack
Variants
Contractor converted to employee
Offboard the contractor identity fully, then onboard as an employee; do not merge.
Vendor with shared access
Rotate any shared credentials the vendor knew.
Why it happens
Contractor offboarding is the most-skipped offboarding because no HR exit interview triggers it. The end date plus this checklist is the safety net.
Edge cases
- Check for personal devices with corporate data (BYOD); retire the corporate profile.
- Review the contractor's recent access logs if the departure was contentious.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_D4yLWWsmLKXbdYokpKh17A