School staff IT onboarding and offboarding

Start with an authorised employment event

Account creation should follow an approved request containing the person's identity, role, manager, start date and expected end date where relevant. Decide who can authorise the request and how IT support confirms it. An email from someone asking for administrator access is not enough by itself.

Include permanent staff, temporary staff, supply workers, contractors, volunteers and staff moving between schools in a trust. Their access needs and expected duration may differ. Use a consistent process without assuming that every person needs the same bundle of accounts.

Build role profiles that reflect real work

Create a small set of documented access profiles, then identify any justified exceptions. A class teacher, finance officer and technician have different responsibilities. Permissions should follow those responsibilities rather than the seniority of the person requesting them.

Access area	Question for the authorising manager
Email and collaboration	Which groups and shared spaces are needed?
MIS	Which pupil records and functions are required?
Finance and payments	Is viewing, preparation or approval needed?
Safeguarding information	Has access been explicitly authorised by the responsible lead?
Website publishing	Can the person draft, approve or publish?
Administration tools	Is privileged access necessary and separately controlled?

Review the profile after a role change. Moving to a new responsibility should not simply add access indefinitely while retaining everything from the previous role.

Prepare equipment and sign-in securely

Allocate a managed device where required and record who is responsible for it. Confirm that the device is configured, updated and able to access the necessary services before the first working day. Include chargers, access tokens and any accessibility equipment in the handover record.

Arrange a secure initial sign-in and account-recovery process. Staff should establish their own credentials and any required additional authentication factors. Do not hand a new colleague a shared password that remains in use by other people. Explain how to report a lost device or suspected account compromise using a channel they can access if their normal account is unavailable.

Make the first-week checks practical

Ask the new member of staff to complete ordinary tasks with their own account: access a class list, open the correct shared documents, send an approved communication or perform the relevant office function. The aim is to find missing or excessive access before it becomes an established workaround.

Provide concise training for the systems they actually use. Explain where school information belongs, how to request help and which actions need approval. Check that accessibility settings and assistive technology work within the managed environment. Record unresolved issues with an owner and a date, rather than relying on the new starter to chase several teams.

Plan a leaving event before the final day

Agree the effective end time for access and any special arrangements with the appropriate manager. Identify the person's accounts, devices, owned documents, shared resources, subscriptions and external service roles. A central login helps, but it does not guarantee that every separate application will stop access automatically.

Decide how business records and responsibilities will transfer. Move necessary shared work into an authorised location instead of asking colleagues to use the departing person's account. Handle mailbox access, forwarding and retention under the school's approved policy and advice. Avoid blanket forwarding that could disclose messages to someone without an appropriate need.

Remove access and verify the result

At the authorised time, disable or remove access as planned, revoke active sessions and deal with relevant authentication tokens. Check separately managed applications, remote access, privileged accounts and services that use local passwords. If the person held a shared secret, assess whether that secret needs changing.

Recover equipment and record its condition and next action. Before reissue, follow the approved reset and data-handling process. Retained school records and the former user's ability to sign in are separate matters: preserving an appropriate archive should not require keeping ordinary access active.

Maintain evidence and cover exceptions

Use a checklist showing the authoriser, scheduled action time, completed systems and unresolved exceptions. A second check is valuable for high-impact access. Define who handles an urgent departure or an incident outside the usual timetable, without leaving decisions to whichever technician happens to see a message.

Periodically compare active accounts against the authorised staff and contractor list. Investigate unused accounts and expired temporary access. Review group membership and administrator roles after restructuring. These routine checks catch missed events and gradual permission growth that a good starter form alone cannot prevent.

For connected systems, use the school integration register to identify access paths. The data retention guide helps separate account closure from the handling of records that still need to be kept.