checklist

Browser extension offboarding checklist

A practical offboarding checklist for removing AI browser extensions, OAuth grants, Chrome policies, password manager access, and sensitive-site permissions when employees leave or change roles.

Published: Jun 25, 2026 Last reviewed: Jun 25, 2026 Audience: Startup founders, IT owners, Google Workspace admins, operations leads, HR partners, and managers who need a repeatable browser-extension offboarding process Risk: Medium Evidence: Chrome Enterprise extension policies, Google Workspace third-party app access controls, Chrome extension management documentation, Google Account third-party app access controls, and Cybergiz extension allowlist templates

Bottom line

Browser extension offboarding is not just removing a Chrome extension. For AI extensions, you also need to revoke OAuth grants, remove role-based policy exceptions, check password manager and SSO exposure, and update the allowlist record so the same access is not silently inherited by the next employee.

Use this checklist for employee departures, contractors finishing work, role changes, failed extension reviews, and any incident where an AI extension had too much access.

Offboarding trigger matrix

Trigger	Risk	Required action
Employee leaves company	High	Remove managed profile, extension access, OAuth grants, password manager access, and SaaS sessions.
Contractor finishes project	High	Remove extension exceptions, OAuth app grants, shared vault items, and project SaaS access.
Employee changes role	Medium	Remove role-specific extensions and blocked-site exceptions that no longer apply.
Extension fails review	High	Move extension to blocked status, remove from allowlist, revoke OAuth, and notify affected users.
Extension vendor changes owner or permissions	Medium to high	Re-score, pause rollout, and remove access until reviewed.
Security incident	High	Disable extension, preserve evidence, revoke sessions, rotate exposed credentials, and update policy.
Device lost or unmanaged	High	Revoke browser profile/session access and connected app grants immediately.

If the extension could read Gmail, Docs, Drive, CRM, source code, support tickets, password manager pages, or admin consoles, treat offboarding as a security control, not a paperwork task.

Pre-offboarding inventory

Before the last working day or access change, collect:

Item	Why it matters
Employee or contractor name	Ties evidence to HR or vendor record.
Role and team	Determines which extensions and sites were allowed.
Browser profile type	Managed work profile, personal profile, contractor profile, or unmanaged browser.
Approved extensions	Pull from the Browser Extension Allowlist template.
AI extensions installed	Include extension ID, vendor, version, and status.
OAuth or connected apps	Extension may still access data after browser removal.
Password manager vaults	Shared credentials and recovery access must be removed.
Sensitive sites used	Gmail, Docs, Drive, CRM, helpdesk, GitHub, finance, HR, admin, production.
Devices and sessions	Offboarding fails if the browser session remains active elsewhere.
Exceptions	Time-limited extension exceptions must be closed or reassigned.

If you cannot inventory the browser reliably, start with account-level revocation: SSO sessions, Google Workspace access, OAuth grants, password manager access, and SaaS sessions.

Extension removal checklist

Run these steps for each departing employee or role change:

Confirm the offboarding trigger and effective time.
Identify all approved browser extensions assigned to the person or group.
Remove the user from Chrome policy groups that allow role-specific AI extensions.
Remove one-off extension policy exceptions.
Confirm the extension is no longer force-installed for that user or group.
Confirm blocked extensions remain blocked after the user leaves.
Revoke extension-related OAuth grants and connected app access.
Remove the user from vendor workspaces for AI browser tools.
Remove shared password manager vault access.
Revoke active browser, SSO, and SaaS sessions.
Check whether the extension synced data to Gmail, Docs, Drive, CRM, Slack, Notion, GitHub, or helpdesk tools.
Record completion in the Small Team AI Security Checklist.

Do not rely on uninstalling the extension alone. OAuth grants and vendor-side accounts can survive browser cleanup.

OAuth and connected apps

AI browser extensions often combine browser permissions with cloud account permissions. Check both layers:

Layer	What to remove
Google Workspace third-party app access	Revoke or restrict apps that can access Gmail, Drive, Docs, Calendar, or profile data.
Individual Google Account access	Remove third-party access granted by the user where relevant.
Microsoft 365 connected apps	Remove Graph/API app grants, Teams integrations, and SharePoint/OneDrive access.
CRM/helpdesk connected apps	Revoke app tokens and integration user access.
Slack/Notion/project tools	Remove bot/app access and user-level authorizations.
Extension vendor account	Remove user from the vendor workspace and rotate shared API tokens.
Browser sync	Disable or remove the managed profile/session on offboarded devices.

If the tool touched customer data, run the workflow through the AI Tool Risk Checker before reassigning access to another user.

Chrome policy cleanup

For managed Chrome environments, review these policy areas:

Policy area	Offboarding action
Extension install allowlist	Remove the user or group from role-specific allowed extensions.
Extension install blocklist	Keep blocked extensions blocked for future users.
ExtensionSettings	Remove per-user exceptions, force installs, runtime allowed hosts, and runtime blocked-host exceptions.
Force-installed extensions	Confirm only core managed tools remain force-installed.
Runtime allowed hosts	Remove sensitive-site access that was granted for the old role.
Runtime blocked hosts	Confirm identity, finance, HR, password manager, source-code, production, and customer-data sites stay blocked.
Managed profiles	Disable or delete old work profiles on company-managed devices.
Pilot groups	Remove offboarded users from pilots and reassign ownership.

The cleanest process is group-based. If a role loses access by leaving a group, fewer manual policy exceptions survive offboarding.

Password manager and SSO review

Browser extension offboarding should include credential systems:

System	Check
Password manager	Remove shared vault items, collections, emergency access, and admin roles.
SSO provider	Revoke sessions, disable account, remove app assignments, and check MFA recovery methods.
Google Workspace or Microsoft 365	Suspend or delete account according to retention policy and revoke third-party apps.
GitHub/GitLab	Remove org/team access, deploy keys, personal access tokens, and browser extension access to source-code pages.
Payment and finance tools	Remove admin access and revoke sessions immediately.
Customer systems	Remove CRM/helpdesk/user-admin roles before reassigning accounts.
Device management	Confirm company device wipe, browser profile removal, or contractor device sign-out.

If an AI extension could run on password manager or SSO pages, use the Password managers and AI browser extensions playbook to decide whether credential rotation is needed.

Role-change checklist

Use a smaller version of offboarding when someone changes teams:

Remove old team browser extension allowlist entries.
Remove old Chrome policy group memberships.
Remove old OAuth grants tied to the prior workflow.
Remove old password manager shared vault access.
Remove access to old CRM, helpdesk, source-code, HR, finance, or admin pages.
Add new role extensions only after approval.
Confirm runtime blocked hosts still cover sensitive sites.
Record the new owner and renewal date in the allowlist.

Role changes are where stale extension access accumulates. Treat them like partial offboarding.

Evidence log

Record this for each offboarding event:

Browser extension offboarding record

Person:
Role or contractor project:
Trigger: Departure / Role change / Extension failed review / Incident / Device lost
Effective date:
Browser profile type:
Managed device:
Extensions removed:
Extension IDs:
Chrome policy groups removed:
OAuth grants revoked:
Vendor accounts removed:
Password manager access removed:
Sensitive systems checked:
Sessions revoked:
Credential rotation needed: Yes / No
Customer data exposure review needed: Yes / No
Owner:
Reviewer:
Completed date:
Follow-up date:

Keep the record lightweight, but make it specific enough that a future incident review can reconstruct what happened.

Failed review workflow

When an extension fails review:

Step	Action
1	Move the extension status to `Blocked` or `Removed` in the allowlist.
2	Add the extension ID to policy blocklist or remove it from allowlist.
3	Remove force-install or allowed-host policy entries.
4	Revoke OAuth and connected app grants.
5	Notify affected users with a short replacement workflow.
6	Review whether the extension accessed Gmail, Docs, Drive, customer data, source code, or admin pages.
7	Decide whether credential rotation or customer-data incident review is needed.
8	Record why the extension failed and when it can be reconsidered.

Do not leave a failed extension in Pending. Pending is for unanswered questions. Failed review means blocked until something materially changes.

Evidence checked

FAQ

Is removing the employee account enough?

No. It helps, but browser extensions can also have vendor accounts, OAuth grants, synced browser profiles, local device state, and role-based policy exceptions. Check each layer.

Should we delete every extension during offboarding?

For a departing user, remove user-specific access. For a role change, remove only old-role extensions and exceptions. Company-wide approved extensions can remain if they are assigned through correct groups.

What is the most common mistake?

Forgetting connected app and OAuth access. A browser extension may no longer be installed, but the vendor or connected app may still have cloud access.

Do contractors need a different checklist?

Use the same checklist, but be stricter about end dates, project-specific groups, shared vault access, and unmanaged devices.

When should we rotate credentials?

Rotate credentials if an AI extension ran on password manager, SSO, admin, source-code, production, finance, or customer-data pages without approval, or if you cannot confirm what it accessed.

Recommended next step

Add this offboarding record to your extension allowlist process. Then review one recent departure or role change and confirm extension access, OAuth grants, password manager access, and Chrome policy groups were actually removed.