Employee Offboarding Checklist for Remote Workers: 15 Critical Steps

Remote employee terminations present unique challenges. You can't walk over to collect a laptop, escort someone out of the building, or ensure devices are wiped on-site. Yet the security risks are just as high—or higher.

This guide covers the complete remote offboarding checklist to protect your organization.

The Remote Offboarding Challenge

What's Different About Remote Terminations

Traditional office termination:

• Employee called to HR office
• IT collects laptop, phone, access badge immediately
• Network access disabled while employee still on premises
• Employee escorted out to ensure no data exfiltration

Remote termination:

• Video call or phone notification
• Devices remain in employee's possession (days or weeks)
• No physical security controls
• Larger window for data exfiltration
• Device return relies on employee cooperation

15-Step Remote Offboarding Checklist

Immediate Actions (Within 1 Hour)

1. Disable All Cloud Authentication

Priority: CRITICAL

Disable accounts in order:

• Azure AD / Microsoft 365
• Active Directory (if hybrid)
• VPN access
• SSO providers (Okta, Azure AD, Google)
• Cloud storage (Dropbox, Box, OneDrive personal)

Why first: Blocks all remote access immediately, regardless of device possession.

2. Revoke All Active Sessions

Force sign-out from all devices:

• Revoke Azure AD refresh tokens
• Clear browser sessions
• Disconnect VPN sessions
• Kill Remote Desktop sessions

Timeline: Sessions expire within 15-60 minutes

3. Reset Password to Unknown Value

Generate random 32-character password:

• Store in password manager (not given to employee)
• Prevents re-authentication if account somehow reactivated
• Required for some applications even if account disabled

4. Block Email Sending

Configure mailbox to reject outbound email:

• Prevents impersonation attempts
• Stops potential client contact during notice period
• Can still receive email (for documentation)

Alternative: Convert mailbox to shared (no send capability)

5. Disable MFA Methods

Remove all multi-factor authentication methods:

• Phone numbers
• Authenticator apps
• FIDO2 security keys
• Backup codes

Why: Even with disabled account, some legacy systems check MFA separately

Communication Phase (1-2 Hours After)

6. Send Equipment Return Instructions

Email employee (personal email, not work) with:

• List of items to return (laptop, phone, monitors, etc.)
• Pre-paid shipping label
• Return deadline (typically 7 days)
• Consequences of non-return (payroll deduction, legal action)
• Confirmation they understand devices will be wiped

Legal note: Check state laws on payroll deductions for unreturned equipment

7. Schedule Exit Interview (Virtual)

Video call with HR and IT:

• Knowledge transfer
• Password handoff (personal accounts used for work)
• Client relationship documentation
• Return of proprietary documents
• Reminder of NDA and non-compete obligations

Data Protection (Same Day)

8. Backup Employee's Work Files

Before wiping devices, preserve business data:

• OneDrive for Business: Grant manager access
• SharePoint sites: Transfer ownership
• Email: Convert mailbox to shared, grant manager access
• Network drives: Copy files to shared location
• Local device data: Remote backup if possible

Timeline: Complete within 24 hours while accounts still accessible

9. Revoke External Sharing

Audit and remove:

• SharePoint external sharing links
• OneDrive public links
• Shared mailbox delegations
• Calendar sharing with external contacts

Risk: Anonymous sharing links remain active even after account disabled

10. Transfer File Ownership

Reassign ownership of:

• Google Drive files (if using Google Workspace)
• SharePoint documents
• Project management tools (Asana, Monday, Jira)
• Design files (Figma, Adobe Creative Cloud)

Device Management (1-7 Days)

11. Remote Device Wipe (Intune/MDM)

For corporate devices:

• Issue full wipe command via Intune/MDM
• Wipe executes next time device connects to internet
• Takes 30-120 minutes
• Verify completion in admin console

For BYOD devices:

• Issue selective wipe (work profile only)
• Removes company data, keeps personal data
• Required by GDPR for personal devices

Issue: Employee may keep device offline to prevent wipe

12. Track Device Return Status

Monitor shipping:

• Tracking number from pre-paid label
• Daily status checks
• Send reminder emails at day 3 and day 6
• Escalate to legal if not returned by day 10

Statistics: 85% of remote employees return equipment within 7 days, 12% require legal intervention

13. Physical Device Verification

When device arrives:

• Verify serial number matches asset inventory
• Check for physical damage
• Boot device to confirm wipe completed
• If not wiped: perform manual wipe
• Remove asset tags and prepare for redeployment

Application & Access Review (Week 1)

14. Audit SaaS Application Access

Many apps not connected to SSO:

• Review 2-factor auth apps on employee's phone
• Check password manager for shared accounts
• Audit social media business accounts
• Review AWS/cloud provider access keys
• Check developer tools (GitHub, Docker Hub)

Common blind spots:

• Personal Dropbox used for work files
• Personal Gmail used for client communication
• Shared credentials in password manager
• API keys in employee's personal GitHub

15. Remove from Communication Channels

Often forgotten:

• Microsoft Teams channels
• Slack workspaces
• Email distribution lists
• Company social media accounts (LinkedIn, Twitter)
• Client communication channels (shared Slack Connect)

Special Considerations for Remote Workers

Home Network Security

Risk: Corporate VPN profile configured on employee's home router

Action:

• Revoke site-to-site VPN connections
• Change shared VPN credentials if used
• Disable split tunneling profiles

Family Member Access

Risk: Spouse or children have used work laptop for personal tasks

Action:

• Assume personal data exists on corporate devices
• Offer employee option to retrieve personal files before wipe
• Give 72-hour window for personal data extraction
• Then proceed with full wipe

International Employees

Complications:

• Device return shipping costs ($50-200)
• Customs delays (1-4 weeks)
• Different labor laws regarding termination notice
• GDPR applies to EU employees (special data handling)

Solution:

• Use local IT support to collect device if available
• Otherwise: Remote wipe, write off device cost if return cost exceeds device value
• Verify wipe completed before writing off

Remote Termination Security Risks

Data Exfiltration Window

Risk period: Time between notification and access revocation

Mitigation:

• Disable accounts BEFORE termination notification
• Monitor cloud storage for bulk downloads
• Set up alerts for large email attachments
• Review file access logs from last 7 days

Device Kept Offline

Risk: Employee keeps laptop disconnected from internet to prevent wipe

Mitigation:

• BitLocker/FileVault encryption (data unreadable if employee doesn't know password)
• Require daily cloud sync as policy
• Legal action for non-return

Shadow IT Access

Risk: Personal accounts used for work not tracked by IT

Mitigation:

• Exit interview question: "What personal accounts did you use for work?"
• Cloud Access Security Broker (CASB) to detect shadow IT
• Review credit card statements for SaaS subscriptions

Measuring Remote Offboarding Effectiveness

Key Metrics

• Time to access revocation: Target: Within 1 hour of notification
• Device return rate: Target: 90% within 7 days
• Wipe completion rate: Target: 100% before device return deadline
• Audit completeness: Target: All 15 checklist items completed

Red Flags

• Access revocation takes longer than 4 hours
• Less than 80% device return rate
• Multiple employees report "forgot" to return device
• Devices returned without wipe completed
• Failed wipe attempts (employee interference)