Volunteer offboarding checklist
When someone leaves the tech team, nursery desk, or office—even on good terms—treat it like a small offboarding. Shared passwords and “everyone knows the Wi‑Fi” are how access lives forever.
Trigger this checklist the same week someone steps down (or immediately if the departure is contentious).
Assign one owner. Keep a dated copy in your church records folder.
1) Accounts (cloud & email)
Microsoft 365
- Block sign-in / reset password; remove licenses when appropriate.
- Follow Microsoft’s former-employee flow: Remove a former employee (save needed mail/files first, then remove or convert the mailbox).
- Remove them from admin roles; confirm Security Defaults / MFA still cover remaining admins (Security Defaults).
- Check Shared mailboxes, Teams, and SharePoint site memberships.
Google Workspace (if used)
- Suspend or delete the user per Google Admin guidance: Delete or remove a user (and related transfer options in Admin Help).
- Remove from Groups that control calendar or drive access.
Everything else
- Church Management System (Planning Center, Church Community Builder, Tithe.ly People, etc.)
- Streaming (YouTube brand account, Vimeo, Restream)
- Social media page roles (Facebook/Meta Business Suite, Instagram)
- Domain / DNS / website host / Cloudflare / Google Domains leftovers
- Password manager org vault (Bitwarden/1Password sharing)
2) Giving & finance platforms
- List every admin on Pushpay, Tithe.ly, Subsplash Giving, Stripe, QuickBooks, bank portal, etc.
- Remove or demote the leaver the same day. Prefer individual logins over one shared “finance@” password.
- Confirm they cannot export donor lists or initiate payouts.
- If a shared password existed, rotate it and store the new one only in the church password manager.
3) Shared passwords & secrets
Rotate anything they might know:
[ ] Staff Wi‑Fi passphrase
[ ] Guest Wi‑Fi (optional; still good after contentious exits)
[ ] Router / firewall / UniFi / Omada admin
[ ] AV rack PC local admin
[ ] Streaming encoder / ProPresenter machine
[ ] Building alarm code (coordinate with facilities)
[ ] Door codes / keypad (if digital)
[ ] Any spreadsheet of passwords (migrate to a real vault, then delete the sheet)4) Keys, badges, devices
- Collect building keys, fobs, AV closet keys; update the key log.
- Collect church-owned laptops, tablets, check-in iPads; wipe and re-enroll before next use.
- Remove their personal device from Wi‑Fi MAC allow-lists if you used them.
- Revoke VPN or remote-access tools (Tailscale, QuickConnect, RDP, ScreenConnect, etc.).
5) Communications
- Announce a new tech contact to staff (not necessarily publicly).
- If they were in public directories or “email us for tech help,” update that page.
- For contentious exits: also review mailbox forwarding rules and MFA methods on remaining shared accounts.
Done checklist (copy for records)
Educational checklist only. Follow your church’s HR/elder policies for staff terminations and any legal holds on email.