Remote Device Offboarding Checklist for IT Teams

Remote employee offboarding looks simple on paper: disable access, get the laptop back, wipe it, close the asset record. In practice, each of those steps can fail independently.

There is no physical handoff at the office. The employee may be working from another city or country. IT may manage identity through one system, VPN through another, the laptop through an MDM platform, and hardware retrieval through email and a courier. If those pieces are not connected, an offboarding that should take a few hours can turn into days of follow-ups and uncertainty.

The important part is not simply having a checklist. It is following the right order: secure access first, protect the device and its data, initiate retrieval, verify the return, and document what happened. This guide gives IT, Security, HR, and Operations teams a practical process they can adapt to their own environment.

Why Remote Offboarding Breaks Down Differently Than In-Office

An office-based employee creates a natural physical handoff — laptop returned, access card handed over, building exited. Remote work removes that forcing function. The laptop may be sitting in an employee’s home hundreds or thousands of kilometres away, with no IT employee nearby and no convenient moment when someone can physically confirm the device has been returned.

There is another complication: access is rarely limited to email. A departing employee may have access to SSO and identity systems, email and collaboration tools, VPN or Zero Trust access, SaaS applications, cloud platforms, shared accounts, administrative tools, API keys, and company-owned devices. For remote teams, ‘disable the employee’ is not one action — it is a sequence of actions that need clear ownership.

The Remote Employee Offboarding Checklist, In Order

The following sequence is designed to reduce the two biggest risks during remote offboarding: continued access and unrecovered equipment. Adapt the exact timing to your company’s security policy, employment arrangements, and the nature of the departure.

1. Coordinate HR and IT before the exit conversation

The offboarding process should begin with coordination between HR, IT, Security, and the employee’s manager — before the exit conversation, not after. Confirm the employee’s final working date and time, whether the departure is voluntary or involuntary, the employee’s current location, devices assigned to the employee, systems requiring access removal, whether the employee has elevated or administrative access, and the return address or preferred retrieval location. This is especially important for involuntary departures, where the timing of access removal may need to coincide with the termination conversation.

☐ HR has confirmed the departure

☐ IT/Security has been notified

☐ Final working time is confirmed

☐ Assigned hardware has been identified

☐ Employee location is confirmed

☐ Special access or privileged accounts are flagged

2. Revoke SSO and email access

Once the access removal window begins, identity access should be addressed immediately. At a minimum: SSO account, corporate email, active sessions, authentication tokens, MFA methods, directory access, and cloud applications connected through the identity provider. Do not assume that disabling one login automatically closes every active session or application connection.

☐ SSO access revoked

☐ Email access disabled

☐ Active sessions terminated

☐ Authentication tokens reviewed/revoked

☐ MFA methods removed

☐ Application access reviewed

3. Revoke VPN and other remote access — separately

This deserves its own step. A common mistake is assuming that disabling SSO handles every remote-access mechanism. It may not. Depending on your environment, explicitly check VPN, Zero Trust Network Access, Remote Desktop, virtual desktop environments, SSH or jump-host access, RMM platforms, firewall exceptions, and administrative portals — as separate items, not as a single checkbox.

☐ VPN disabled

☐ ZTNA policies reviewed

☐ Remote desktop access revoked

☐ Server or SSH access removed

☐ RMM access removed where applicable

☐ Firewall exceptions reviewed

4. Rotate shared credentials

If the departing employee knew a shared password, API token, recovery code, or other credential, removing their personal account does not necessarily remove their ability to use that credential. Identify any shared access associated with the employee and rotate where required: shared inbox credentials, admin passwords, service accounts, API keys, cloud credentials, database credentials, vendor portals, and emergency access codes. Scope depends on the employee’s role.

☐ Shared passwords identified

☐ Privileged credentials reviewed

☐ API keys reviewed

☐ Service-account access reviewed

☐ Required credentials rotated

5. Wipe the company device remotely

If the company laptop is enrolled in an appropriate endpoint management system, IT may be able to initiate a remote lock or wipe without physically possessing the laptop. There is often no operational reason to wait until the device arrives at a warehouse before protecting company data. The exact capability depends on the operating system, MDM configuration, device state, and whether the laptop can receive the management command. For devices that are offline, the command may not execute until the device reconnects. The key distinction: data protection and physical recovery are two different jobs. A remote wipe can help protect corporate information. It does not bring the laptop back.

6. Send a prepaid return kit or shipping label

Once access has been secured, make the physical return as easy as possible. The return kit should tell the employee exactly what needs to be returned, where it goes, how it should be packaged, who pays for shipping, when it must be returned, and how the shipment will be tracked. Every additional action required from a former employee creates another opportunity for the return to stall. For the operational detail on making this process work, see our guide on getting laptops back from remote employees.

☐ Return instructions sent

☐ Prepaid label or return kit arranged

☐ Deadline communicated

☐ Equipment list included

☐ Tracking reference recorded

7. Track the shipment until the device arrives

Sending the label is not the end of the process. The IT or Operations team should know the device’s status at each stage: not shipped, shipped, in transit, delivered, received, verified. That status should live in the same asset record wherever possible. A device marked ‘return requested’ is not the same thing as a device physically recovered — that distinction matters when reporting recovery rates and asset availability.

8. Verify the device when it arrives

When the laptop arrives, do not simply mark the ticket as complete. Verify the serial number, asset tag, device model, charger and accessories, physical condition, return date, data-wipe status, and any reported damage. The serial number should match the device assigned to the employee — this prevents closing the wrong asset record because the return was tracked only through a shipping reference.

☐ Device received

☐ Serial number verified

☐ Asset tag verified

☐ Accessories checked

☐ Physical condition recorded

☐ Return date recorded

9. Document the entire offboarding record

The final step is documentation, not ‘laptop received.’ Six months later, the company should be able to answer: when was access revoked, who performed the action, when was the device wipe initiated, did the wipe complete, when was the device returned, what condition was it in, and what happened to the device afterward. This matters for internal accountability as much as it does for formal compliance requirements.

☐ Access revocation recorded

☐ Wipe action recorded

☐ Return tracking recorded

☐ Serial number confirmed

☐ Device condition recorded

☐ Final disposition recorded

☐ Exceptions documented

10. Route the device to its next stage

Getting the laptop back is not the end of its lifecycle. Once the device has been received and appropriately sanitized, decide whether it should be redeployed, repaired, refurbished, stored as spare inventory, resold, recycled, or disposed of through an appropriate ITAD process. If the device is still suitable for another employee, immediately replacing it with a new laptop creates unnecessary hardware expenditure. Our guide on reusing returned devices instead of rebuying covers this next stage in detail.

The Two Mistakes That Cause the Most Trouble

Mistake 1: Waiting for the laptop before protecting the data

One of the biggest process errors is treating physical recovery as a prerequisite for data protection. If a company-managed laptop can receive a remote lock or wipe command, IT can potentially protect corporate data before the device is physically returned. That does not eliminate the need to retrieve the hardware — it simply means the security process does not have to wait for the logistics process. The two workflows should run in parallel: access protection → remote device controls → physical retrieval, not: wait for laptop → receive laptop → start thinking about security.

Mistake 2: Assuming SSO revocation covers everything

SSO has made access management significantly easier, but it should not create a false sense of completeness. VPN access, privileged credentials, shared passwords, API keys, remote desktop access, and other systems may require separate actions depending on the company’s architecture. A good offboarding checklist should list the actual access channels rather than a single ‘disable employee’ checkbox. The more distributed the company’s technology stack, the more important this distinction becomes.

What If the Device Doesn’t Come Back?

A good process should already have an escalation path: return request → reminder → second follow-up → manager/HR escalation → formal recovery process. The exact escalation should depend on company policy, employment agreements, and applicable law — HR and legal teams should determine what actions are permissible in the relevant jurisdiction.

The device should already be protected through the company’s available endpoint controls where technically possible. That changes the risk profile: instead of simultaneously dealing with an unsecured company device and an uncooperative former employee, the company is primarily dealing with an asset recovery problem. Document each stage of the escalation — original request date, return deadline, reminder dates, employee responses, tracking information, and manager or HR involvement.

What Changes for International Employees?

International offboarding introduces additional complexity. A former employee may be willing to return the laptop, but the physical process can still take longer because of cross-border shipping, customs requirements, local courier availability, higher shipping costs, regional holidays, and time-zone differences. A return process that works perfectly for an employee in New York may be inefficient for someone leaving from Singapore or Mumbai. For distributed teams, local retrieval options can reduce the number of international shipping steps involved.

A Note on BYOD

Bring Your Own Device requires a different offboarding process because the hardware belongs to the employee. The organization needs to determine what corporate data, accounts, and applications exist on the device and what controls are available under its BYOD policy — this may involve removing corporate accounts, revoking access, deleting managed applications, or using selective data removal rather than wiping the entire device. The exact process should be defined in the company’s BYOD policy before the employee leaves. Company-owned device: recover and securely sanitize it. Employee-owned device: remove or protect corporate data and access without treating personal hardware as company property.

How Remoasset Connects the Offboarding Workflow

The biggest problem with remote offboarding is often not that individual tasks are technically difficult — it is that the tasks are spread across different systems and different people. HR knows when the employee leaves. IT knows how to revoke access. Security manages device controls. Operations coordinates shipping. Asset management tracks the laptop. Remoasset connects the employee event with the physical device workflow, including retrieval coordination, asset tracking, and the next lifecycle decision — so the routine steps happen consistently, in the right order, without relying on someone remembering to start them. Book a demo to see how the sequence triggers automatically from an HRIS offboarding event.