Salesforce gives you three states for getting a user out of the org: Freeze, Deactivate, and (for Customer 360 / Identity-licenced contexts) Disable.
Freezing stops the user from logging in immediately but does not free up their licence. Use it as a fast first response — someone left unexpectedly, or you suspect a compromised account. They keep ownership of all their records, sharing remains intact, and you can unfreeze instantly. Find it on the user record under Freeze.
Deactivating is the proper offboarding step. It frees the licence so it can be reassigned, blocks login, and stops automation that runs as that user. The catch: deactivation is blocked while the user owns records or is referenced in certain places (account team membership, default workflow user, recurring scheduled jobs, queue membership). You either reassign ownership first or — for fast removal — freeze first, then clean up ownership over time.
You can't delete a user in Salesforce. Once a user record exists, it's there forever; you can only deactivate. That's because audit trails reference the user ID and need to remain interpretable indefinitely.
Order of operations for offboarding: Freeze immediately -> reassign owned records -> remove from groups/queues/team memberships -> deactivate.