SaaS Onboarding & Offboarding Checklist for IT Teams

Why SaaS Onboarding and Offboarding Matters

SaaS sprawl has created a new operational challenge for IT teams. Most organizations now run 200 to 400 different SaaS applications, yet onboarding and offboarding workflows often remain manual, fragmented, and error-prone. The consequences are significant: security breaches, wasted spend, and frustrated employees.

Getting onboarding and offboarding right isn't just about efficiency. It's a foundational part of SaaS governance and risk management.

Security risk: orphaned accounts after offboarding

When an employee leaves, their access should be revoked immediately. In reality, 83% of former employees retained access to accounts at their previous employer after departing. Over 30% of organizations take more than three days to fully revoke system access, leaving sensitive data exposed. This is why 53% of IT security leaders cite orphaned accounts from poorly offboarded employees as their top cybersecurity concern.

Every day an account remains active after departure increases the risk of data theft, credential compromise, or unauthorized access to sensitive systems. The longer the delay, the higher the exposure.

Cost risk: paying for licences of departed employees

SaaS licenses are expensive, and many organizations continue to pay for accounts long after employees have left. Research shows that 30 to 50% of SaaS licenses go unused across the average organization, with roughly 30% of total SaaS budget wasted on underused or entirely unused subscriptions. When you combine unused licenses with post-departure stragglers, the annual cost impact is substantial.

Effective offboarding includes immediate licence reclamation and seat reassignment. This alone can reduce SaaS spend by thousands of dollars annually.

Productivity risk: new hires waiting days for tool access

On the flip side, new hires who don't receive timely access to the tools they need become unproductive from their first day. Research shows that 43% of employees were still waiting for basic tools and workstation setup after more than one week on the job. This delay damages first-week morale and pushes ramp-up timelines back by days or weeks.

Proactive SaaS onboarding ensures new hires have access to role-appropriate tools before they walk through the door, allowing them to contribute from day one.

The SaaS Onboarding Checklist (by Role and Department)

Effective onboarding requires a structured, role-based approach. Different departments need different tools, so a one-size-fits-all approach wastes money on unused licenses and fails to equip teams with what they actually need.

The best practice is to build department-specific onboarding playbooks ahead of time, then trigger them automatically when a new hire is added to the HR system.

Pre-day-one: provisioning core apps

Timeline: 2 to 3 days before start date

Before the employee's first day, provision access to company-wide tools and department-specific applications. This requires coordination between HR, IT, and department managers. Using Cledara's onboarding workflows, you can compile both company-wide and team-specific SaaS stacks, then trigger automated provisioning that ensures the right tools are available when the employee logs in.

Core company apps (everyone):

• Email (Gmail, Outlook, or equivalent)
• Single sign-on (SSO) system (Okta, Azure AD, or equivalent)
• Internal chat (Slack, Microsoft Teams)
• Cloud storage (Google Drive, OneDrive, Dropbox)
• Document collaboration (Google Docs, Microsoft 365, Notion)
• Password manager (1Password, LastPass, Bitwarden)
• Video conferencing and scheduling tools (Zoom, Calendly)

Actions to complete before day one:

• Create email account and add to relevant distribution lists
• Provision SSO identity and assign to appropriate groups
• Create workspace account in Slack or Teams and assign to correct channels
• Set up cloud storage folder structure and share team folders
• Create a password manager vault for the new hire
• Provision video conferencing account
• Add employee to company calendar and scheduling tools

Day one: access verification and training

Timeline: first day of employment

On the employee's first day, verify that all provisioned access works correctly and provide a brief walkthrough of critical tools.

Day-one checklist:

• Test email login and verify mailbox access
• Confirm Slack or Teams login and channel memberships
• Verify cloud storage folder access and permissions
• Test SSO sign-on process with all provisioned applications
• Provide password manager credentials and walk through setup
• Confirm video conferencing account works (test audio and video)
• Add new hire to company handbook, onboarding documentation, and internal wikis
• Schedule training sessions with department manager for department-specific tools

Week one: department-specific tools

Timeline: days 2 to 7

During week one, the new hire's manager provisions role-specific tools and trains the employee on their usage. This is where department-specific onboarding becomes critical.

Below is a typical role-based onboarding matrix showing which applications different departments commonly require:

Week-one department-specific checklist:

• Identify role-specific tools required for the new hire's position
• Provision access to those applications with appropriate permission levels
• Schedule training sessions with subject matter experts or team leads
• Verify the new hire can authenticate and navigate each application
• Provide documentation, templates, and workflows specific to the role
• Assign an onboarding buddy or mentor for tool-related questions

For organizations using Cledara, these department-specific workflows can be triggered automatically based on the employee's role and department in your HR system. New hires can also use Cledara's Request Access feature to request additional tools directly, with application owners approving or denying requests through a full audit trail. This eliminates the ad-hoc Slack messages and lost requests that plague manual provisioning.

The SaaS Offboarding Checklist

Offboarding is just as important as onboarding, yet many teams treat it as an afterthought. A structured, timeline-based offboarding process ensures security, protects data, and recovers SaaS costs immediately.

Immediate actions (same day): revoke access, transfer data

Timeline: day of departure (within hours)

The moment an employee's departure is finalized, IT should immediately revoke access to all systems and transfer critical data. Every hour an account remains active increases risk.

Same-day offboarding checklist:

• Notify IT, HR, department manager, and security team of departure
• Disable email account and set up forwarding to manager or designated colleague
• Revoke SSO access and force logout from all active sessions
• Revoke Slack or Teams access and remove from all channels
• Remove from all distribution lists and shared calendars
• Disable VPN access and remove from corporate network
• Disable access to all cloud storage (Google Drive, OneDrive, Dropbox)
• Transfer ownership of files, folders, and documents to the manager or team lead
• Disable code repository access (GitHub, GitLab, Bitbucket)
• Revoke access to cloud infrastructure (AWS, Azure, GCP)
• Revoke access to all business-critical SaaS applications (CRM, project management, etc.)
• Freeze or cancel virtual cards associated with the departing employee
• Collect company devices (laptop, phone, monitors, peripherals)

For organizations using Cledara's offboarding workflows, all active subscriptions and access points for the departing employee are flagged automatically. You can revoke access, reclaim licences, and freeze associated virtual cards in a single workflow. Because Cledara issues a unique virtual card per subscription, freezing the card means the vendor cannot charge for the next billing cycle. No waiting for vendors to process cancellation requests.

Within 7 days: licence reclamation, account deletion

Timeline: days 1 to 7 after departure

After immediate access revocation, spend the next week reclaiming SaaS licences and deleting or archiving accounts. This prevents ongoing charges and ensures no residual access paths remain.

7-day offboarding checklist:

• Remove the departing employee from all SaaS subscription licences (Salesforce seats, HubSpot licences, Microsoft 365 seats, etc.)
• Cancel or downgrade any individual SaaS subscriptions paid for by the employee
• Request permanent account deletion from vendors where data retention policies allow
• Archive email accounts for legal hold and compliance (if not deleting immediately)
• Archive or remove the employee's Slack workspace account
• Revoke any connected third-party applications or integrations tied to their account
• Update your SaaS management platform to reflect licence removals
• Communicate to the finance team that the employee's name should be removed from upcoming SaaS renewals
• Cancel any expense cards, virtual cards, or corporate payment methods tied to the employee

This is a critical step for SaaS spend management. Every unused seat you reclaim is immediate savings and prevents accidental re-provisioning.

Within 30 days: audit for orphaned accounts

Timeline: days 8 to 30 after departure

The final phase of offboarding involves a comprehensive audit to catch any missed applications, orphaned accounts, or lingering access that may have been overlooked.

30-day audit checklist:

• Pull a complete list of all SaaS applications in use from your SaaS management platform
• Cross-reference against the employee's access provisioning records to ensure every app was disabled
• Search for any subscriptions still charging under the employee's name or email address
• Review payment card and billing records to confirm no charges remain tied to the departing employee
• Check for any integrations or connected applications (Zapier, Make, IFTTT) tied to the employee's account
• Search employee-specific projects, repositories, or data stores in infrastructure tools
• Verify that shared documents and files owned by the employee have been transferred or archived
• Review security logs and SSO audit trails for any unexpected login attempts
• Contact department managers to confirm all role-specific tools have been disabled
• Update the employee directory and IT asset management system to reflect the completed offboarding

For shadow IT, this audit phase is especially important. Employees often sign up for applications that aren't formally managed by IT. A comprehensive audit using a SaaS management platform like Cledara can surface these orphaned accounts and prevent them from becoming security or compliance liabilities.

Offboarding Timeline and Responsibility Matrix

Below is a high-level offboarding timeline showing key tasks, timeframes, and owners:

Automating Onboarding and Offboarding with Cledara

Manual onboarding and offboarding are slow, error-prone, and consume significant IT resources. Automation is the only way to scale these processes reliably as your company grows.

Cledara integrates directly with your HR system. With HRIS integrations across 30+ systems (including BambooHR, CharlieHR, HiBob, Personio, Workday, Gusto, and JustWorks), onboarding and offboarding triggers pull automatically from your HR system. When a new employee is added, onboarding workflows trigger without manual intervention. When an employee's departure date arrives, offboarding workflows initiate automatically.

Key automation capabilities:

• Onboarding workflows: Compile company-wide and team-specific SaaS stacks, then trigger workflows that provision access to the right tools for each role. No spreadsheets, no Slack messages, no missed applications.
• Offboarding workflows: Flag all active subscriptions and access for departing employees. Revoke access, reclaim licences, and freeze virtual cards in one workflow.
• Request Access: New hires request tools through Cledara instead of asking around on Slack. Application owners approve or deny requests with a full audit trail, so every access decision is documented.
• Virtual cards for instant cancellation: Freeze the departing employee's associated virtual cards immediately. Because each subscription has its own card, there's no waiting for vendors to process cancellation requests.

The results speak for themselves. Cledara customers see a 23% average reduction in SaaS costs and save over 13 hours per month on SaaS admin tasks. For a company managing 100+ SaaS applications, that time savings translates to entire workdays reclaimed each month.

Beyond automation, Cledara provides full visibility into your SaaS stack, helping you understand which SaaS licences are actually being used and which are sitting idle. This addresses the root cause behind most onboarding and offboarding failures: organizations simply don't know how many licences they have or who has access to what.

Downloadable Checklists

To help you implement these processes at your organization, we've created downloadable onboarding and offboarding checklists tailored for IT teams managing SaaS at companies with 30 to 500 employees.

What's included:

• Complete SaaS onboarding checklist organized by timeline (pre-day-one, day one, week one)
• Department-specific app provisioning matrix for six common departments
• Complete SaaS offboarding checklist organized by timeline (same day, 7 days, 30 days)
• Offboarding responsibility matrix with task owners and priority levels
• Shadow IT audit checklist for the 30-day post-departure review
• HRIS integration planning template for automating onboarding and offboarding triggers

Download the checklists and customize them to match your organization's specific tools and processes. Share them with department managers and keep them updated as your SaaS stack evolves. A repeatable, documented process is the foundation of effective SaaS governance.