How do you Offboard Remote Employees Securely?

When a remote employee leaves, the last day happens in pieces. Your account manager in Lisbon finishes on a Friday, and HR enters the date from Chicago. The offboarding job picks it up overnight, and her single sign-on account closes around 7 a.m. Saturday, her time.

Her laptop reaches your IT depot nine days later. All that time, the phone on her kitchen counter keeps the team's chat app open, because the app holds its own session and nobody deactivated her account there. The offboarding ticket follows the laptop, since the laptop is the only part of a remote departure anyone can hold.

Remote employees offboarding runs identity first, because identity is the one thing you can take back on the last day. To offboard remote employees, end their access at a time set in their own time zone, sign them out of every device they used, personal ones included, and secure the company laptop remotely before it ships. In this article you will learn where a remote worker's access survives the cutoff, how to time it across time zones and video terminations, how to recover laptops and close sessions on personal devices, and how to handle staff hired through an employer of record.

How is remote employee offboarding different from office exits?

Remote employee offboarding reverses the order of an office exit. In an office, the badge, the laptop, and the accounts all come back on the last afternoon, at the same desk. Remotely, access ends at a timestamp you choose, the laptop arrives days or weeks later in a box, and the personal phone with work apps on it never arrives at all.

That moves the last day into your admin consoles. The usual remote checklist (a revoke-access task, a prepaid return kit, a hand-off, an exit call over video) treats the returned laptop as the finish line. The access that lives elsewhere never makes the ticket.

We know the pattern well. Lumos is a 100% remote company, so nearly every offboarding we run ends with a video call and a shipping label.

When every app is SaaS, the app list covers most of the perimeter. Marqeta is 100% cloud-based, with almost no on-premises footprint, and every workforce service it runs is SaaS. In its first two months on Lumos, it automated onboarding and offboarding, managing access to more than 150 apps.

For a company built that way, closing app access does most of the work of a cutoff. The person's role still sets how much there is to close, since how to offboard an employee starts from what their job let them reach. Working from home changes where that access lives once they've gone.

Seven places a remote worker's access outlives the identity provider

Disabling a remote worker in your identity provider stops new sign-ins to most connected apps. What it leaves running (open sessions, cached sign-ins, synced files, and accounts the identity provider never issued) sits in seven places, and the company owns only two of them.

Treat the table as a worksheet for offboarding remote employees. Each row names where access survives, what ends it, and who owns that step.

‍

The laptop and the remote access paths are the only rows the company owns outright, which is why an offboarding that ends at the laptop can't finish. Each row also depends on when access ends, and for remote staff that hour is easy to get wrong.

Copy the table into your offboarding runbook and put a named person in each "Who owns it" cell. A row with no name is a row nobody will close.

Termination dates and time zones for distributed teams

A termination date on its own doesn't tell your tools when a remote person's access should end, because the same date means a different hour everywhere your people live. Many HR records store the date with no time attached, and the jobs downstream read it at whatever hour their sync runs, or as midnight wherever the company sits. The cutoff ends up wherever the schedule puts it.

Which way it misses depends on the clock, and on whether a tool reads the date as the start or the end of the last day. Read as midnight Eastern at the start of a Friday last day, the date cuts off someone in Honolulu at 7 p.m. Thursday, before they've handed anything off. Read as midnight Pacific at the end of that Friday, it leaves someone in Manila with working access until 4 p.m. Saturday, nearly a full day after they logged off.

Set the cutoff by departure type instead. For a resignation, access ends at the close of the person's last working day in their own time zone. For an involuntary exit, it ends on the call, once the person has heard the news. Someone employed through an employer of record follows the same rules, adjusted for garden leave, which the employer of record section below covers.

That only works if the HR record carries a time and a time zone, which makes it the first field to fix when you work out how to automate HR onboarding and offboarding.

Once the time is on the record, booking the cutoff is the easy part. Lumos's Offboarding API runs an offboarding right away or at a scheduled future time, and whichever tool learns about the termination first can call it. Convert the person's local close of business into that scheduled time when HR enters the date, and the cutoff lands at the end of their day.

Export last quarter's leavers with their termination date, the time access really ended, and their home time zone. Count how many lost access during their last working day and how many kept it overnight.

How do you fire a remote employee securely over video?

To fire a remote employee securely over video, deliver the news first, then cut access and send device commands on HR's signal within the same minute. In an office, IT walks the laptop out of the room. On a video call, the laptop sits in front of the person, who can close the lid or switch off Wi-Fi before anyone says goodbye.

Hold the call on a line that doesn't depend on the person's work accounts, such as a phone dial-in or a guest meeting link. Otherwise the cutoff ends the call mid-sentence, usually before HR has explained what happens next.

Write the run sheet with HR before the call:

1. Before the call, confirm in device management that the laptop is online, and stage the offboarding so it's ready to run.
2. In the first minute, HR delivers the decision.
3. On HR's signal, IT cuts privileged access and remote access, including VPN certificates, then ends sign-in and sessions and sends the device lock where it's supported.
4. Before the call ends, HR covers the return instructions and the person's obligations after they leave.

For a remote employee, a chat app going dark is how they'd find out they've lost their job, so the news has to come first, by a minute, not an hour. The rest of the cut order, from apps outside single sign-on to shared credentials, belongs to the IT offboarding process. Who hears next is a question for the offboarding communication plan.

Device commands go out in that minute because device management can only reach a laptop that's online. Microsoft's Intune documentation says a wipe or retire sent to an offline device stays pending until it checks in, and if it never checks in before its management certificate expires, the command never runs. Remote lock has a limit of its own: Microsoft offers it for Macs, iPhones, iPads, and company-owned Android devices, and Windows laptops aren't on the list.

Until a command lands, a laptop kept offline still opens with the person's cached password and holds every file it synced. Disk encryption protects that data from whoever finds the laptop and does nothing against the person who knows the password. For Windows laptops, decide with legal ahead of time whether the wipe goes out at the cutoff or waits for the box. Either way, keep your most sensitive files online-only, so there's less on any laptop to begin with.

Treat the laptop as a device in transit until it's checked in

Once access is cut, a laptop in a shipping box is a data problem. Keep it enrolled until it's back in your hands, and set a deadline for when you stop waiting. The IRS shows what happens without one.

Of more than 32,000 IT assets held by IRS employees who left between April and July 2025, 1,308 hadn't come back by November 2025, according to an August 2026 report from the Treasury Inspector General for Tax Administration. Hundreds were still missing the following April. Policy required people to return devices but set no deadline, and devices passed through managers and local IT offices that didn't send them on.

The missing devices' storage hadn't been cleared either, which turned each one into a question about taxpayer data. A return chain with several hand-offs and no deadline loses devices, and each lost drive that still holds data leaves you guessing what was on it.

Cut the hand-offs out first. Ship the return kit with a prepaid label addressed to your IT depot, so no manager or local office ever holds the device, and give it a tracking number and a deadline. The laptop stays enrolled until it arrives, which keeps a remote wipe within reach.

On arrival, IT checks for a legal hold, then wipes and reimages the laptop to your sanitization standard. If the deadline passes first, the same hold check comes before a remote wipe, and the device moves to your lost-asset process.

Managers drop out of the chain of custody, and they're still the people a departing employee is most likely to answer. Add a Send Notification step to the Lumos offboarding workflow for the departing person's manager, and the return date reaches them by email, Slack, or Teams on the last day.

Because access ended first and the drive is encrypted, a box that never arrives costs you the hardware, not an account.

End the sessions on devices you never issued

Sessions on a personal phone or home computer sit outside every device control you own, so they end from the identity side or they don't end. Think of the phone with work mail and chat, the tablet on the couch, and the home computer whose browser has been signed in to the team's tools for a year. Locking or wiping the company laptop touches none of them.

Chat is the usual survivor, as it was for the account manager in Lisbon. Many chat and file apps keep their own sessions, so disabling single sign-on stops new sign-ins and leaves the open app running until the account in that app is deactivated too.

End sessions where they live, at the identity provider and in each app that keeps its own. Remove the person's MFA factors next, since an authenticator on a personal phone is a second key that outlives the job. Where the phone had a work profile, send a selective wipe that removes the company's apps and data and leaves the rest, after checking local data protection rules for staff outside the US. Testing that a disabled account stops working is one of the employee offboarding best practices that matters most when the devices aren’t yours, so run it the morning after and put anything that still works on your manual list.

CIS Controls v8.1 has a safeguard for each half of this. Safeguard 4.11 asks for the ability to remotely wipe enterprise data from enterprise-owned portable devices when appropriate, such as when a device is lost or a person no longer works for you. Safeguard 4.12 asks for separate enterprise workspaces on mobile devices where supported, such as an Apple configuration profile or an Android work profile. That separation is what makes a selective wipe possible on a phone you don't own, and it has to be in place long before anyone gives notice.

Device trust shrinks the problem before anyone leaves. Intercom moved most access requests to self-service in Lumos and kept strong security through device trust-based authentication. When an app checks the device as well as the person, a personal tablet that fails the check can't open a session there to begin with.

In Google Workspace, Lumos offboarding includes an action that signs a person out of all web and device sessions, which Lumos Support turns on. Google's admin help notes that resetting a user's sign-in cookies doesn't sign them out of apps such as Gmail and Drive for desktop. Plan a separate step for those, and for each app that isn't Google's.

Pull the sign-in log for your last three remote leavers and list each device that held a session in their final month. Mark the ones your device management tool has never seen, because only the identity side could end those.

Prevent departing employee data theft before the last day

A home office opens exits IT rarely watches, and preventing departing employee data theft means closing them during employment, because by the last day whatever went through them is gone. Four rows of the table describe them: personal browser profiles, personal cloud and email, remote access tools, and partners' shared channels. None of them closes when the account does.

A case Secureworks described in 2024 shows how early the data can go. A North Korean operative, hired under a false identity as an IT contractor, started moving proprietary data to a personal cloud account through the corporate virtual desktop almost as soon as the job began. The company later fired the contractor for poor performance, and ransom demands followed with samples of the stolen data attached.

The firing only set off the extortion. The data had been leaving since the first weeks, through a path no offboarding step could close.

Close those paths while the person still works for you. Block uploads to personal cloud storage from managed devices, alert on new forwarding rules to outside addresses, keep browser sync for work profiles inside company accounts, and allow only the remote access tools IT sanctions. For staff in Europe, clear that monitoring with local counsel, and with the works council where one exists, before you switch it on. Once someone resigns, the notice-period steps in the employee offboarding checklist set what to watch.

At the cutoff itself, delete any forwarding rules and calendar shares still in place, since a mailbox with sign-in blocked keeps receiving mail and its rules keep running.

Offboarding international employees through an employer of record

When an employer of record employs someone, the termination lands first in that provider's platform, on a date local law sets. The EOR is the legal employer in the person's country, so the termination, the date it takes effect, and any notice period run through its platform and its lawyers.

Notice periods set by local law can run for weeks or months, and garden leave keeps someone employed after their working access should end. If your offboarding listens only to your primary HRIS, it can hear about these people late, through an email, or not at all.

Treat the EOR's platform as a source of leaver events, and give its people the same cutoff as everyone else. Working access ends at the close of the last working day, or the day garden leave starts if that comes first, while the employment runs on to the date local law sets.

Any remote offboarding software you run should hear from the EOR directly, because a tool that listens only to your primary HRIS can miss anyone the EOR employs who isn't mirrored there. The best identity governance software for a distributed team treats the EOR as one more HR source. Lumos connects to Deel and to Remote, the global HR platform, as HRIS integrations, so EOR records can feed the same lifecycle workflows as everyone else's.

Ask HR for everyone employed through an EOR or paid as an international contractor, and check that each one's termination reaches IT without anyone sending an email.

Make identity the first step of every remote offboarding

A remote departure pulls attention toward the box, because a tracking number is the one part of it anyone can watch. For the account manager in Lisbon, the laptop arriving nine days late was the smaller problem. The chat app still open on her phone was the bigger one, and no tracking number would have shown it.

Start with the access: put a time zone on every termination, end sessions on the devices you never issued, rehearse your next remote termination, give every return a deadline, and make your employer of record a trigger. Do those, and a remote exit ends on a schedule you chose, wherever the person lives. The box comes back when it comes back. The access ends when you say it does.

The access half has to run without anyone watching the clock. Lumos Lifecycle Management starts the leaver workflow from the termination in your HRIS and revokes access across identity providers, local accounts, custom apps, SaaS, cloud, and on-premises apps in one run. A removal that fails comes back as an error task with retries, and every revocation lands in the audit trail your auditor will sample. Book a demo to see Lumos close out your next remote leaver on their last day, wherever they work.

‍