Offboarding remote employees securely? 5 checks to run

Offboarding remote employees securely means a timed, documented process: revoke accounts (Microsoft 365, VPN), recover or wipe devices, secure cloud data, remove third‑party access and log every action — aim to complete the core 5 checks within 24–48 hours of notice and follow NCSC guidance.

Check 1 — Credentials still active after notice; revoke all access within 24 hours

Problem: leavers often keep live credentials — shared accounts, service admin roles or legacy VPN credentials — long after their contract ends. Diagnosis: if HR and IT don’t share a timestamped exit notice, access can remain open and become a backdoor. Action: create an automated revoke runbook that targets primary identity providers and common apps. Start with the corporate IdP (Azure AD/Microsoft 365), your VPN concentrator, and SSO provider. Revoke primary sessions first and reset any shared passwords.

Step playbook: disable sign‑in, remove group memberships, and revoke refresh tokens.
Quick check: force token invalidation for Microsoft 365 and any OAuth grants.
Evidence: attach a dated screenshot or log entry to the employee record.

Where possible, enforce a policy that access is removed within 24 hours of notice; if that’s operationally impossible, record an exception window and the approving manager.

Check 2 — Devices not returned or unencrypted; enforce device recovery and remote wipe

Problem: unreturned laptops, phones or home NAS devices may hold customer data and credentials. Diagnosis: absence of a device inventory and MDM profiles means IT cannot verify encryption or run a remote wipe. Action: maintain a device register linked to HR records and enrol company devices in an MDM (e.g., Microsoft Intune). When someone leaves, trigger a staged policy: lock and backup, then remotely wipe if the device isn’t returned within an agreed timeframe.

Practical items: ask for device serial numbers at hiring, label equipment, and require asset acknowledgement.
MDM benefits: push encryption checks, force passcodes, and perform selective wipe for corporate data.

Record the device return or wipe certificate in the leaver’s file so auditors can show the chain of custody.

Check 3 — Cloud folders and shared drives hold orphaned business data; export and preserve what’s required

Problem: departing staff often hold ownership of shared drives, Teams channels or Git repos, which can block access or lead to uncontrolled copies. Diagnosis: missing ownership transfer or export rules leaves data discoverability gaps and legal risk. Action: run a quick inventory of owned buckets, channels and repos, then transfer ownership to a team account and export critical records before deleting the user account.

Identify high‑risk stores: shared drives, CRM exports, customer correspondence, code repos.
Export audit logs and message history where retention is required.
Update your retention register and link each export to a retention reason.

For data protection compliance, align decisions with the ICO’s recordkeeping expectations and keep an auditable export log.

Check 4 — Third‑party app authorisations and delegated admin rights persist; audit and remove OAuth grants

Problem: leavers may have granted third‑party apps OAuth access (calendar, drive) or retained delegated admin rights on SaaS tools. Diagnosis: these permissions are commonly forgotten because they live outside the central IdP. Action: query OAuth grants across the estate, list delegated admin roles on core systems, and rescind them.

Run app‑permission reports in Microsoft 365 and Google Workspace.
Check delegated access in billing portals and remove former user billing contacts.
Revoke service account keys and rotate any API credentials exposed to the leaver.

Tip: add a single line in your exit checklist that requires confirmation that “no external app retains user grants.” Add the remote‑working checklist to HR’s leaver pack so IT gets an automatic trigger.

Check 5 — HR and IT out of sync on timing; enforce a dated exit checklist and central logging

Problem: HR sends an exit email to line managers but IT doesn’t get a single authoritative instruction with a timestamp, so actions are delayed or missed. Diagnosis: manual handoffs and informal WhatsApp threads cause ambiguity. Action: use a single dated exit checklist that both HR and IT sign off electronically; log each action into a central audit store (ticketing system, SIEM or simple spreadsheet with hashes).

Required items on the checklist: access revocation, device return/wipe, data exports, third‑party revocations, and final payroll clearance.
Make the checklist machine‑readable so ticket creation is automatic on leave date.
Store logs for an agreed retention period for compliance and incident response.

Small change, big effect: when HR and IT share one timestamped record, missed steps drop sharply and forensic reconstruction is easier.

Final practical step: run a table‑top offboarding drill once a quarter to time how long the five checks take end‑to‑end and close any gaps.

FAQ

How quickly should I revoke access for a remote leaver in the UK?

Aim to revoke primary access within 24 hours of formal notice; this includes IdP sessions, VPN and SSO tokens. Fast removal limits lateral movement and matches common NCSC access‑management advice.

Can I remote‑wipe a staff member’s personal device?

Only if your employment contract and device policy explicitly permit it; otherwise offer a corporate‑data wipe or ask the employee to surrender the device. Always document consent or the legal basis before wiping.

What minimum records should IT keep after an offboard?

Keep a dated log showing who revoked access, when devices were returned/wiped, and what cloud data was exported — this three‑item record is sufficient for routine audits and incident enquiries.

If I miss one of the five checks, what’s the most likely consequence?

The typical outcomes are unauthorised access to data or third‑party compromise, which can lead to GDPR enforcement action or customer churn — both of which are costlier than fixing the missing check promptly.