Deprovisioning Remote Employees: A Device and Access Runbook

The single most important operational detail is timing: access to email, code repositories, shared drives, and any customer-facing systems should be revoked at, or within minutes of, the termination conversation, not at the end of the day or the next morning. Build a checklist tied to your identity provider so revoking one central login cuts off connected systems automatically, rather than requiring someone to manually disable a dozen separate accounts under time pressure.

Getting a laptop back from someone in another country takes real logistics: a prepaid shipping label in their local postal system, clear instructions on packaging, and a defined deadline. Build this into your offboarding process as a standard step with a tracked deadline, and have a policy for what happens if hardware isn't returned, including whether the cost is deducted from final pay where local law allows, which varies significantly by country and should be confirmed with your EOR or local counsel rather than assumed.

If your device management tooling supports remote wipe, trigger it as part of the same access-revocation sequence, don't wait for the physical hardware to arrive back at your office. A laptop sitting in transit for two weeks with an active company login and cached credentials is a real exposure window, not a theoretical one. Remote wipe and physical recovery are two separate controls; use both rather than treating the wipe as optional if you're getting the hardware back anyway.

Single sign-on covers most modern tools, but check for the accounts that slip through: a personal device enrolled in your mobile device management, a shared password for a legacy vendor tool, API keys or service accounts tied to that person's identity, and any local admin access on shared infrastructure. Maintain a standing checklist of these non-SSO systems so offboarding doesn't rely on someone remembering them under pressure.

For example, an engineer leaves and their single sign-on account is disabled within minutes, but a service account they created for a reporting script still runs under their name, and a shared password for a legacy vendor tool is still known to them. Neither appears in the identity provider, so neither gets cut off. The fix is a standing inventory of non-SSO access, with a named owner for each item, reviewed whenever someone with admin or integration duties joins or leaves. Then offboarding means working through a list rather than recalling each account from memory while the termination conversation is already under way.

In many countries, the process and required notice for terminating employment is itself regulated, and access revocation timing needs to fit within what's legally permitted, not just what's operationally convenient. Coordinate the technical deprovisioning sequence with whoever is managing the local termination process, usually your EOR, so the security steps don't inadvertently create a separate employment law problem.

A week or two after an offboarding, check that nothing was missed: confirm the hardware shipment was received and wiped, verify no access re-appears through a synced personal device or a forgotten integration token, and check whether any shared accounts the person knew the password to (a legacy vendor login, a shared social media account) were rotated. Offboarding rarely fails at the checklist step; it fails at the thing nobody thought to put on the checklist, which is exactly what a short follow-up audit is designed to catch.

A short follow-up audit should confirm that:

• The hardware shipment was received and the device was wiped.
• No access has reappeared through a synced personal device or a forgotten integration token.
• Shared accounts the person knew the password to, such as a legacy vendor login or a shared social media account, have been rotated.
• Anything the checklist missed is added to it, so the next offboarding starts from a better list.

Most departures are routine, and a standard checklist executed calmly is enough. For a termination that's likely to be contentious, a security incident, a performance dispute, or anything where the person might react badly, move the access-revocation timing earlier relative to the conversation itself, and involve IT and legal in planning the sequence in advance rather than improvising it in the moment. The extra coordination cost is small compared to the risk of an upset departing employee having live access for even a few extra minutes, and having a pre-agreed elevated-risk version of the checklist means nobody has to design one under pressure.