IT vs. HR: Who's Responsible for What During Onboarding and Offboarding? (Enterprise)

Enterprise onboarding and offboarding can span multiple HR and IT teams, business units, regions, and systems. Responsibilities may already be defined, but that doesn’t mean the process works the same way across the organization.

A hire in one region may follow a different device or access workflow from a hire elsewhere. Offboarding may involve both global policies and local teams. The challenge is creating an ownership model that works consistently across all of them.

Why the IT–HR boundary is structurally hard to draw at enterprise scale

Enterprise teams are managing a constant flow of hires, departures, internal moves, and reorganizations. Each event can set off multiple actions across contracts, devices, identity, applications, and security, often with different teams responsible for each one.

The volume makes small gaps in coordination much harder to absorb. A role change recorded by HR, for example, may require several separate access changes from IT. If one of those actions doesn’t follow, the employee’s access can fall out of sync with their new responsibilities.

Clear ownership therefore has to work at the level of each lifecycle event: who initiates it, who acts on it, and what tells the next team it’s their turn.

Onboarding | Who owns device procurement at enterprise companies?

At enterprise scale, device procurement has to work across a high volume of hires, locations, and local requirements. IT needs accurate information about who is joining, where they’re based, when they start, and what equipment they need early enough to source and prepare devices consistently.

HR owns the trigger: Once a hire and start date are confirmed, HR should make sure the information IT needs enters the device procurement process. That includes the employee’s location, role, start date, and equipment requirements.

IT owns device provisioning: IT is responsible for sourcing the device, applying the appropriate configuration and security requirements, enrolling it in Mobile Device Management (MDM), and coordinating delivery.

Where enterprise teams can get stuck: A single procurement process may need to work across countries with different suppliers, availability, delivery times, and logistics. If regional teams follow different processes or standards, device provisioning becomes harder to manage consistently across the organization.

Learn why new hires start without equipment — and how to fix it.

Onboarding | Who owns access provisioning at enterprise companies?

At enterprise scale, access provisioning can span identity systems, core business applications, regional tools, and applications managed by individual teams. The challenge is applying access requirements consistently when employees in similar roles may sit in different business units, locations, or technology environments.

HR owns the employee information: HR makes sure IT has accurate information about the employee’s role, team, manager, location, and start date. Hiring managers or application owners may also need to confirm access that is specific to the employee’s responsibilities.

IT owns account and access setup: IT translates those requirements into accounts and permissions and applies security controls such as Single Sign-On (SSO) and Multi-Factor Authentication (MFA). Where Role-Based Access Control (RBAC) policies are in place, they can help standardize access for defined roles.

Where enterprise teams can get stuck: Not every application sits within the same identity or provisioning environment. Legacy systems, regional tools, acquired technology, and applications owned by individual business units can follow different access processes. That makes it harder to maintain a consistent access baseline across the organization, even when roles are clearly defined.

See also: IAM best practices for distributed teams.

Role change | Who owns access governance at enterprise companies?

Enterprise role changes can be more complex than a straightforward promotion. Employees may move between business units, regions, or legal entities, take on temporary assignments, or gain access for specific projects. Each change can affect several parts of their access profile at once.

HR owns the trigger: HR records permanent changes to the employee’s role, team, or organizational position and makes sure IT has the information needed to act. Managers or application owners may need to provide additional context for temporary or project-specific access.

IT owns the access update: IT reviews the employee’s existing permissions, removes access that no longer matches their responsibilities, and grants what the new role requires. For temporary access, IT can also apply appropriate review or expiry controls.

Where enterprise teams can get stuck: An employee’s access may have been granted through different systems, teams, and stages of their career. When they move internally, updating the obvious role-based permissions may not address access inherited from previous teams, regional systems, or temporary projects. Over time, that can contribute to privilege creep.

Find out what happens when access is not revoked on time.

Offboarding | Who owns access revocation at enterprise companies?

At enterprise scale, revoking access can mean coordinating changes across identity systems, business applications, regional platforms, and shared resources. The process also needs to account for different types of departures, from employees and contractors reaching a planned end date to exits that require more tightly controlled timing.

HR owns the trigger and timing: HR confirms the departure and makes sure IT knows when the employee’s access should end. For planned departures, that may be the end of the employee’s last day; other exits may require access to be removed at a specific time.

IT owns access revocation: IT disables the relevant accounts, ends active access, and removes permissions across the systems and applications the employee used. It should also maintain a record of what was revoked and when.

Where enterprise teams can get stuck: Access may be distributed across centrally managed identity systems, regional applications, legacy platforms, and tools owned by individual business units. Different worker populations may also follow different offboarding processes. Without a consistent view across those environments, completing and verifying access revocation becomes harder.

Discover the 5 most common offboarding failures on remote teams.

Offboarding | Who owns device recovery at enterprise companies?

At enterprise scale, device recovery can involve a large fleet distributed across countries, offices, and remote locations. IT needs to coordinate returns across that footprint while keeping track of which devices are still with departing employees, which are in transit, and which have been recovered.

HR owns the employee communication: HR makes sure departing employees understand which equipment needs to be returned, when it’s due, and what the return process involves.

IT owns device recovery: IT coordinates the return, tracks the device through the recovery process, and handles the technical steps required once it is recovered, including secure data erasure where appropriate.

Where enterprise teams can get stuck: Recovery processes can vary across locations, particularly when different teams or providers handle returns. At fleet scale, inconsistent processes make it harder to maintain a clear view of device status and ensure recovered equipment is processed appropriately.

Read: Certified data erasure for compliant device offboarding.

Offboarding | Who owns SaaS and application cleanup at enterprise companies?

At enterprise scale, software can be owned and managed across IT, Finance, business units, regional teams, and application owners. Acquisitions can add another layer of tools and contracts. When an employee leaves, identifying their full application footprint can therefore require coordination across several parts of the organization.

HR owns the trigger: HR confirms the departure and makes sure the relevant teams know when the employee’s access should end.

IT owns application cleanup: IT removes access to the applications and shared resources it manages and coordinates other changes needed as part of the employee’s departure.

Ownership may extend beyond IT: Business units and application owners may manage tools outside the central IT environment, while Finance may hold information about software contracts and spend. Those teams may need to contribute to the offboarding process where access or software ownership sits with them.

Where enterprise teams can get stuck: Software visibility can be fragmented across centrally managed applications, regional tools, business-unit purchases, and systems inherited through acquisitions. That makes it harder to establish whether all relevant access has been removed and whether software associated with the departing employee still needs to be reassigned or reviewed.

Download the Employee offboarding checklist.

The IT–HR responsibility matrix: who owns what, and when

At enterprise scale, ownership may be distributed across global and regional teams, business units, and application owners. This matrix provides a starting point for defining who owns each lifecycle action and what triggers the next team to act.

How Deel IT connects IT and HR across the employee lifecycle

Enterprise HR and IT teams may operate across different regions, systems, and areas of responsibility. Deel IT brings device, access, software, and employee workflows into one platform, helping teams manage those processes more consistently across the organization.

For enterprise teams, that means greater visibility and coordination across the employee lifecycle:

• Standardize device provisioning across locations: Procure, configure, and ship devices to employees while managing device requirements and security from one platform.

• Manage a distributed device fleet: Keep track of company devices and apply security policies throughout the device lifecycle.

• Coordinate access with employee changes: Manage application access as employees join, change roles, move between teams, or leave.

• Improve visibility across software and access: Give IT a clearer view of applications and employee access across a complex software environment.

• Coordinate global device recovery: Manage returns across distributed teams, track devices through recovery, and securely erase company data when appropriate.

• Support employees across locations: Give distributed employees access to IT support without relying entirely on regional HR or IT teams.

• Bring lifecycle operations into one place: Manage devices, software, access, and employee changes together, giving enterprise teams a more consistent operating model across the organization.

Explore Deel IT to see how enterprise teams can manage employee IT across the lifecycle.

Book a demo