Dealership Employee Offboarding Checklist: The IT Steps for Every Hire and Every Exit

A dealership employee offboarding checklist lists every system a departing employee can reach, who shuts each one off, and where their calls and email go next. Run it in reverse for new hires, and access stays tied to the job.

Last updated: November 9, 2026

Erik Nachbahr, Helion’s founder, told a story on a content planning call in early November that I keep coming back to. “We have a dealer that didn’t want to move to Microsoft 365, because they said, ‘We don’t want to pay for all the extra licensing we’ll have, because we don’t remove employees from the system when they leave, so it’s going to cost us a lot of extra money.’ That was their reason for not going to 365.”

That dealer knew. The people who had left were still in the system, and by the dealer’s own math there were enough of them to raise the license bill. We’ve also seen people who were fired 6 months earlier with access that still worked.

I’ve spent more than 20 years at Helion, and this is one of the plainest ownership problems in managed IT support for dealerships. Below are the two lists I’d want a store or group to run, one for the last day and one for the first. We’re keeping this to joiners and leavers. Access control as a whole is a bigger conversation, and it’s a separate post.

What Should a Dealership Employee Offboarding Checklist Include?

Start with one owner. That person cuts Microsoft 365 access first, works through the DMS, the CRM, and every other login the role had, reassigns calls and email, gets the devices and shared passwords back, and finishes with a dated sign-off. If it isn’t signed, it didn’t happen. For new hires, pair the checklist with a signed acceptable use policy.

1. HR or the manager tells the list’s owner who’s leaving, their last day, and whether it’s a termination.
2. Microsoft 365 goes first: reset the password, sign them out of all sessions, then block sign-in.
3. Work from the saved list for their role: DMS, CRM, F&I tools, manufacturer portals. Don’t go from memory.
4. Where do their calls go now? Reassign the extension, voicemail, ring groups, and CRM lead routing.
5. Forward the mailbox or convert it. Somebody has to watch it. Name them.
6. Get the laptop, company phone, and keys back. Wipe company data from the phone.
7. Shared logins, door codes, alarm codes: if they knew it, change it.
8. Update the help desk contact record, release the license, and sign the list with today’s date.

Why Microsoft 365 Has an Order to It

Blocking sign-in feels like the obvious first move, but Microsoft’s own former employee steps say “Blocking an account can take up to 24 hours to take effect.” The same page says to reset the password to stop sign-in immediately, and signing them out of all sessions can take up to an hour unless an admin uses the PowerShell command Microsoft lists for an immediate sign-out. So do all three. Reset first. If your accounts sync from an on-premises Active Directory, make the change there too, because Microsoft notes that the directory sync can overwrite a change you make only in the cloud. Our Microsoft 365 security for dealerships page covers the rest of that environment.

Calls and Email Are Where Leads Get Lost

A salesperson leaves on Friday. Their cell number is on a stack of business cards, their email is in a customer’s inbox, and unless someone changes the routing, the CRM can keep handing them new leads on Saturday. The customer just stops hearing back.

Microsoft gives you two ways to handle the mailbox. Forwarding sends only new email to the next person. Converting to a shared mailbox keeps the old email and calendar too, and it doesn’t need a license as long as the mailbox stays under 50 GB. Pick one. Write down who’s watching it. Then leave the account in place, because Microsoft is direct about that: “Don’t delete the account if you’ve set up email forwarding or converted it to a shared mailbox.”

The help desk record belongs on this list too. Our help desk has verified every caller since November 17, 2023, and the preferred check is a one-time code sent to the email or mobile number already on the contact’s record. If a former employee’s details are still on that record, the record is wrong. So fix it. Do it the same day.

The Systems to Cover, First Day and Last Day

Your list will be longer than this one. Add every vendor login your stores pay for.

Leave a system off, and it gets missed.

AI Accounts Belong on Both Lists

Corporate AI licenses are the easy case. In a DealersEdge webinar on AI governance, posted to our YouTube channel in October, Erik described it this way: “you add a user to a group in your corporate system and boom, it hands out a license for Claude and they can use it. And then if you need to get them out of there, boom, you get them out of there.” That’s the whole step.

Personal accounts are the opposite. That’s the hard case. In the same webinar, Erik gave the example of a salesperson who uploads a customer list into their own AI account: “Well, now those belong to them and they can take it with them when they go.” There’s no step on your checklist for that, because the store never controlled the account. Our post on AI governance for dealerships covers how to give people an approved path instead.

You can’t offboard an account you don’t own.

Why Dealerships Feel This More Than Most Employers

NADA’s 2021 Dealer Workforce Study, as reported by BDO, put overall dealership turnover at 46% a year and sales consultant turnover at 67%. That’s older data, and your store’s number will differ. Still, at 46%, a 100-person store is working through about 46 exits a year, and every one of them needs a new hire set up too. That’s a lot of accounts.

Employee offboarding, in IT terms, means ending a departing person’s access to every system, device, and shared password, then handing their calls, email, and data to someone else. Onboarding is the same work run forward: role, approval, access, record. Neither job is hard when one person owns the list.

Ownership is where it comes apart. Onboarding can be scattered across about 10 people at a dealership. One person in service sets up one system, someone else adds the next, and when that employee leaves, no single person knows everything they were given. I’d rather see one list than 10 people with good memories.

Look at what an old login can do. A former employee with a working CRM login may still be able to see or export customer records, depending on what the role allowed. Anyone else who gets that password signs in looking like staff. And an account nobody remembers is an account nobody’s watching. The FTC Safeguards Rule comes down in the same place. 16 CFR 314.4(c)(1) says to “Authenticate and permit access only to authorized users” and to “Limit authorized users’ access only to customer information that they need to perform their duties and functions.” We treat that in our dealership compliance program as something a store runs and can show. So keep the list. It’s your proof.

Someone who left in May isn’t an authorized user in November.

How Should IT Onboarding Work at a Dealership?

IT onboarding at a dealership starts from one request form and a role template. Each system gets a named approver. IT builds the account from the template, turns on multi-factor authentication, and adds the new hire to the help desk record. Now the store knows exactly what that person was given. It’s written down.

1. One request, one form. The hiring manager names the person, role, store, and start date.
2. Pick the role template.
3. Get a named approval for each system. A controller might approve accounting access, for example, and a service manager the shop systems.
4. IT builds it, and the Safeguards Rule requires multi-factor authentication for anyone accessing an information system, unless your Qualified Individual has approved an equivalent or stronger control in writing (16 CFR 314.4(c)(5)).
5. Help desk contact record: add their email and mobile number. Today.
6. Save the completed form, because it’s the first half of their offboarding list.

We use a user account request form at Helion for exactly this, and the reverse process when someone leaves. The form isn’t clever. It doesn’t need to be. It works because everything goes through it.

Stop Copying the Last Person

Here’s Erik again: “Historically, they’ve always copied employees, rather than having templates set for their role, and that’s how people get permissions they shouldn’t have.”

You can see how it happens. A new service advisor starts Monday, so someone opens the account of the advisor at the next desk and copies it. That advisor used to work in parts and helped with warranty for a while, and all of that access comes along to someone who has never worked a parts counter and has no reason to open a warranty claim. Now there are two of them. A role template is a short standardized list of what the job needs, written once and approved once. It’s simpler, and it’s easier to support.

Permissions drift as well. People get promoted or change departments, and unless the move triggers a review, they keep what they had. So treat a role change as both lists at once. Take off what the old job needed, then add what the new one needs.

One List Across Every Rooftop

Groups have one problem a single store doesn’t. People transfer. Say a sales manager moves to another rooftop and picks up new access. If nobody at the old store is told, those logins stay on, which leaves one person able to reach two stores’ customer records for no reason anyone at either store could give you. Now the CFO asks who can see what across the group. If every store has its own habits, nobody can say.

That’s why my advice to dealer groups doesn’t change much here: consolidate IT support and standardize process. One form. One set of role templates. One owner for the list, with the same steps at every store. You also stop paying for licenses nobody’s using.

Before You Hand This to HR

Try It on One Name

Pick someone who left your store last quarter. Just one. Look them up in Microsoft 365, the DMS, and the CRM. Then call their old extension and see who answers. You’ll know where you stand. Do it this week.

Helion supports more than 35,000 dealership employees across 2,000-plus dealerships, so we’ve seen a lot of people come and go. Want an outside look? Start with a complimentary IT and cybersecurity assessment. It reviews your current technology, security posture, and vendor spend, and where you stand against the FTC Safeguards Rule. You’ll have the findings in writing, and what you do with them is up to you.