How to Handle Remote Employee Offboarding Without Losing Control
Gregg DavisUpdated 10 min read
When someone leaves from the office, the last day has physical anchors. They hand over the laptop and badge, IT checks the serial number against the asset record, and the conversation happens in a room.
When someone leaves from home, none of that happens. The laptop is in their house, maybe in another country. Company data may sit on a personal phone or a home computer. The person may be eight hours ahead of IT, and the exit conversation happens on a video call that runs on the very account you’re about to disable.
The tasks don’t change with location: access, data, licenses and devices all need handling. Our IT offboarding checklist lists them, and our guide to removing access for terminated employees covers the cutoff on the day. This guide covers only what’s different when the employee is remote, and how to plan for it.
Getting Equipment Back
IT asset recovery is the part of remote offboarding that takes longest and fails most often. In the office, the hand-over is a moment. Remotely, it’s a shipment that depends on a former employee packing and posting it after they’ve stopped working for you.
Send the Return Kit Early
Send the kit as soon as the departure date is set, not on the last day. A week or two of lead time gives the box time to arrive and the person time to use the laptop for handover work before packing it.
A good kit makes returning easier than not returning:
- A box sized for the device, with padding, so nobody has to find packaging.
- A prepaid, tracked return label, already filled in.
- A card listing exactly what comes back, by item and asset tag: laptop, charger, phone, security keys, monitors, docks and anything else on the asset record.
- The ship-by date and a named person to contact with questions.
Ask the person to confirm their shipping address before you send anything. HR records go stale, and a kit sent to an old address is the start of a lost device.
Larger items such as monitors and office chairs often cost more to ship than they’re worth. Decide up front, by item, whether it comes back, goes to a local recycler or stays with the employee, and put it in your policy so the answer is the same for everyone.
Track Every Shipment
Record the return tracking number against the asset in your asset system, so whoever checks the record can see where the device is. When the box arrives, check the contents against the list by serial number before you close the task. A box that arrives with the wrong laptop, or with the charger but no laptop, is easy to miss if you only check that something came back.
For involuntary terminations, have the kit and label ready to send the same day as the conversation. The person shouldn’t have to ask how to return anything.
Employees in Other Countries
International returns bring customs forms, duties and longer transit times, and for older devices the shipping can cost more than the device is worth. Some organizations use a local IT disposal partner instead, who collects the device, wipes it and provides a certificate. Our guide to IT asset disposal covers what a sanitization certificate should show. Whatever you choose, decide it per country before the first departure there, not during it.
When the Equipment Doesn’t Come Back
Most late returns are inertia, not theft. A short, clear follow-up sequence resolves most of them:
- A reminder to the personal email address on file, a few days after the ship-by date.
- A phone call or text, with the tracking label resent.
- A formal written request from HR, with a final deadline.
- Escalation to HR and legal for a demand letter or other recovery.
Don’t deduct the device’s value from a final paycheck without legal advice. Whether you can, and how, depends on the jurisdiction and on what the employee signed. Document every attempt to contact the person, and in parallel treat the device as lost: lock it, mark it in the asset record and protect the data on it, as below.
Locking and Wiping Devices Remotely
A device you can’t hold is a device you have to control from a distance. That depends on it being enrolled in mobile device management (MDM) before the departure, so make enrollment part of onboarding, not something you discover you need at offboarding.
Lock Before Wipe
A lock keeps the person out but leaves the data in place. A wipe erases everything. Lock first when you need the data later, such as files that were never synced, or a device that may be needed for a legal hold. Wipe when the device isn’t coming back or once its data has been preserved.
For an involuntary termination, send the lock at the moment of the cutoff. For a resignation, there’s usually no need to lock a device the person is about to ship back.
Commands Wait for the Device to Check In
MDM commands are delivered the next time the device connects. A laptop that stays off, or offline, won’t receive the lock until it does. It may also still open with the cached credentials on it, even after the account is disabled. Full-disk encryption, such as BitLocker on Windows or FileVault on macOS, with the recovery keys held by IT, is what protects the data on a device that never comes back online.
Clear Activation Locks
Apple’s Activation Lock ties an iPhone, iPad or Mac to the Apple ID that turned on Find My. If that’s the employee’s personal Apple ID, a returned device can be unusable until they sign out. Ask them to sign out before packing it. Devices enrolled through Apple Business Manager and supervised by your MDM can usually have the lock cleared by IT instead.
Cutting Access Across Time Zones
The cutoff itself, disabling the account and everything that hangs off it, is the same for remote employees, and the termination-day checklist covers it. Two things change.
Whose End of Day?
“Access ends at the end of the last day” needs a time zone. If your systems run on head office time, an employee in Sydney may lose access mid-morning or keep it into their next day. Schedule the cutoff in the employee’s local time, and agree it with them in advance so they can finish handover work.
For an involuntary termination, the cutoff follows the conversation, wherever the employee is. That can mean disabling an account at 6 a.m. for IT. Automate the cutoff, or put a named person on call for it. Don’t rely on whoever happens to be online.
Remote Access Is the Only Access
For a remote employee, VPN, virtual desktops and cloud applications aren’t the extra paths in. They’re the only paths in, so close every one of them. Disable the identity provider account, then revoke its active sessions. In Entra ID, for example, access tokens already issued can keep working for an hour or more unless you revoke sessions or the application supports continuous access evaluation. Revoke VPN certificates and end any open VPN or virtual desktop sessions rather than waiting for them to time out.
Personal Devices and Home Networks
Remote employees mix work and home more than office staff do. Some of what needs cleaning up isn’t on any device you own.
Personal Phones and Computers
If company mail or apps are on a personal phone, remove only the company data. MDM and app protection policies can wipe the managed work apps and leave the rest of the phone alone. Never send a full wipe to a personal device, and tell the employee in advance what will be removed, so it isn’t a surprise.
Then check the less visible connections:
- Sign-in methods registered to personal devices, such as an authenticator app or a phone number used for multi-factor authentication.
- Browser profiles signed in to a work account, which may sync saved passwords and bookmarks to a home computer.
- Mail forwarding rules to personal addresses, and files shared with personal accounts.
- Desktop sync clients for company storage on home computers.
Home Networks and Local Copies
Company data can end up in places IT can’t see: a home NAS, a USB drive, a personal cloud account. You can’t inspect someone’s house, so rely on policy instead. Remote work agreements should say company data stays on company systems. At departure, ask the employee to confirm in writing that they’ve deleted any company data from personal devices and storage. Our guide to data security during offboarding covers the monitoring to do during the notice period.
Some remote employees also have company-owned network equipment at home, such as a firewall, a VPN appliance or a mobile hotspot. Put it on the asset record and the return list like any laptop. Equipment bought with a home office stipend needs a clear policy on who owns it, written before anyone leaves.
The Exit Conversation by Video
The departure conversation is harder on a screen. There’s no handshake, no walk to the door, and the call itself may depend on the account being disabled.
Plan the Call Around the Cutoff
For an involuntary termination, send the invitation to the employee’s personal email or phone, or include a dial-in number. If the call runs on company Teams or Zoom and the account is disabled when it starts, the person can be dropped mid-sentence. Agree with IT on the minute the cutoff runs, have HR and the manager on the call, and keep a phone number to call if the connection drops.
Follow Up in Writing
After the call, send a written summary to the personal address: the last day, final pay and benefits, what to return and how, the ship-by date, and who to contact. A remote employee can’t walk down the hall to ask, so a clear written record prevents most of the follow-up questions.
Voluntary Departures
For resignations, schedule the exit interview and a farewell call with the team on video, the same as any meeting. Record knowledge transfer sessions and keep the handover notes in a shared space, since there are no hallway conversations to fill the gaps. Our guide to IT knowledge transfer during offboarding covers what to capture.
How ezOnboard Helps with Remote Offboarding
ezOnboard handles the account side of remote offboarding from your HR system. It connects your HR system to Active Directory, Entra ID and Exchange, so HR stays the source of truth and nobody needs to file an IT ticket.
When HR records a departure, your offboarding rules take over on the timeline you set. ezOnboard disables the account, removes group memberships, reclaims Microsoft licenses and forwards mail. Applications that sign in through Entra ID lose access when the account is disabled. Nobody has to be watching an HR calendar, whichever time zone the employee works in.
Every change is recorded with the HR event and the rule behind it, so you can show when a remote leaver’s access was removed. Safety rails stop a run that would disable more accounts than your limits allow, before it changes anything.
Shipping kits, MDM locks and the exit conversation stay with your team. ezOnboard takes the most time-sensitive part off their plate.
Book a demo to see it with your own HR system, or check the ROI calculator to see what it could save you.
Frequently Asked Questions
How do you get a laptop back from a remote employee?
Send a return kit as soon as the departure date is set: a padded box, a prepaid tracked label and a card listing every item by asset tag. Confirm the shipping address first, record the tracking number against the asset, and check the serial numbers when the box arrives.
What if a remote employee doesn’t return company equipment?
Follow up by personal email and phone, then with a formal written request from HR, and escalate to legal if needed. Get legal advice before deducting anything from final pay, since the rules depend on the jurisdiction. In the meantime, lock the device through MDM and treat it as lost.
Can you wipe a remote employee’s personal phone?
Wipe only the company data. MDM and app protection policies can remove managed work apps and their data while leaving personal content alone. Tell the employee in advance what will be removed.
When should access be cut for a remote employee in another time zone?
For a resignation, at the end of the last day in the employee’s local time, agreed with them in advance. For an involuntary termination, at the time of the conversation, whatever time that is for IT. Automating the cutoff means it doesn’t depend on someone being awake.
How should a remote termination call be handled?
Invite the employee through a personal email or phone number so the call survives the account being disabled. Have HR and the manager on the call, time the cutoff to it, and follow up in writing with return instructions, final pay details and a contact.