A cloud storage employee offboarding checklist should separate file preservation from account shutdown. Identify content the person owns, choose an accountable successor, transfer or relocate required files, test links and permissions, preserve records under policy, and only then remove access and licenses. Vendor behavior differs, so confirm the organization's actual Google Workspace, Microsoft 365, or other provider settings before deleting an account.

Name the decision makers and timing

Record the departing user, manager, file custodian, administrator, final work date, and account-disable date. Ask the manager which active projects, client deliverables, templates, reports, automations, and shared links must continue. Involve legal, records, or security staff when a hold, investigation, regulated record, or sensitive dataset is involved.

Do not use a departing employee's password or sign in as that person. Use the provider's authorized administrative transfer and access-delegation tools.

Inventory ownership, not just visible folders

Search for files owned by the user, files in personal storage, shared folders, shortcuts, externally shared items, scheduled exports, form destinations, and documents linked from project systems. Note whether each item is user-owned, organization-owned, or stored in a team or shared-drive location.

Ownership and location matter. A file visible inside a shared folder can still have a different owner, and a shortcut can point to content that will disappear later. Record high-value links before transfer so they can be tested afterward.

Prepare the receiving owner and destination

Choose an active account with enough storage, appropriate privileges, and a clear business role. Prefer a team-owned location for durable shared work when the provider and policy support it. Create a destination structure and agree on what will be transferred, archived, or intentionally deleted.

Google's administrator file-transfer guidance says the current and receiving accounts must meet eligibility conditions and describes transferring an organization's Drive files to a new owner. It also notes that transfer results can include a folder in the new owner's Drive and that some files remain in existing shared locations.

Transfer before irreversible account changes

Suspend sign-in or otherwise contain access according to the organization's security process, but do not rush past file preservation. Transfer owned content using the provider's administrative workflow. For data that cannot be transferred directly, use an approved export or copy process and document what changes, such as file identifiers, versions, comments, links, or sharing permissions.

Microsoft's OneDrive retention and deletion documentation explains that deleting a user starts a OneDrive lifecycle with configurable retention and access-delegation behavior. The default and policy outcomes can vary, so the administrator should verify the tenant's current retention, manager, secondary owner, and hold settings rather than relying on a remembered deadline.

Verify the handoff as the recipient

Ask the new custodian to open a sample from every important project. Test edit rights, shared links, embedded files, forms, spreadsheets with connections, and files referenced by websites or automations. Confirm that external collaborators still have only the intended access. Check whether old links remain valid or need updating.

Compare the transfer result with the inventory. Investigate files in Trash, unorganized content, personal shortcuts, and storage owned by other users. A transfer confirmation is evidence that a provider operation finished, not proof that every business dependency works.

Remove access and clean up connected systems

After the content owner signs off:

  1. Revoke the departing user's sessions, app passwords, tokens, and synchronization clients through the approved identity process.
  2. Remove direct shares, group memberships, and external links that are no longer needed.
  3. Reassign automation connections, form ownership, reporting destinations, and notification recipients.
  4. Preserve audit and retention records required by policy.
  5. Remove licenses or delete the account only when the transfer, retention, and recovery plan has been confirmed.
  6. Recheck critical files after the provider's deletion or retention transition.

Avoid broad permission changes that give the successor access to unrelated personal or confidential material. Apply least privilege and have the manager approve exceptions.

Close with an evidence record

Keep the inventory, transfer receipt, receiving location, sample-test results, access changes, retention decision, administrator, approver, and date. Note any unresolved ownership or broken links with a due date.

The strongest process does not depend on a grace period rescuing missed files. It establishes ownership and usable access before the old account becomes unavailable, then verifies the final state from the successor's perspective.

Sources

  1. Transfer Drive files to a new owner as an admin — Google Workspace Admin Help
  2. OneDrive retention and deletion — Microsoft Learn

Related reading