How IT Teams Automate Employee Offboarding and Recover Devices and Licenses
IT teams automate user offboarding by linking the HR system, identity provider, device management, and an IT asset register so one event (a leave date is entered) generates a full list of what the leaver owns and triggers all the tasks required to get it back.
Without that link, someone has to remember to do it, someone has to remember which laptop that person had, and no one notices the 6 SaaS seats still billing 3 months later. Those holes for mid-market businesses with hundreds of employees leaving their companies annually are a total loss of hardware, an unnecessarily high licensing bill, and open access that will be questioned by auditors.
The quick response: automate the trigger, the inventory of what the person holds, access and license removal, and the evidence trail. Leave humans to the parts that require judgment, like chasing a remote employee for a laptop or deciding whether to reassign or cancel a license.
The guide explains what each step of an automated offboarding workflow is, who's responsible for which step, and how to retrieve devices from remote leavers, as well as what to do with each individual freed license and how IT asset management (ITAM) software, like Setyl, connects the dots for IT departments in 2026.
Why Offboarding Leaks Devices, Licenses, and Access
The problem with offboarding is that it fails because IT doesn't consider it important. It's not because the information you need to do it well isn't in one place, owned by one team.
HR knows the leave date, but often tells IT late, or only on the last day.
The identity provider (Okta, Microsoft Entra ID, Google Workspace) knows the accounts, but not the apps that sit outside single sign-on, or what they cost.
The MDM (Intune, Jamf, Kandji) knows enrolled devices, but not the monitor, dock, headset, or phone that was handed over in the office.
Finance knows what's being paid for, but not who is using it.
This leaves three separate leaks. Devices are lost through the door, or left in a leaver's house, forever. Licenses are always active until the next renewal, and sometimes auto-renew. Access remains in applications that no one ever looked at, and becomes a security issue.
That's where automation comes in: it brings all those sources together around the person, not the system. If the offboarding checklist writes itself, it's because IT can view one employee record and all devices, licenses, and admin roles that belong to them.
The Automated Offboarding Workflow, Stage by Stage
The workflow below is for a leaver, starting when the notice is given and ending when IT can confirm everything is taken care of. Each stage mentions what can be automated and what requires a person.
Stage 1: Trigger (when notice is given)
Automate: Leave date automatically submitted to IT when entered in the HRIS (BambooHR, HiBob, Workday, Personio, or other) or identity provider flows. The leaver status becomes "offboarding," and the system notifies the involved people.
Keep manual: Ensure that any special or unusual cases are confirmed with HR, for example, if one employee wants the access removed sooner than the last day.
Why it matters: Most offboarding issues start late in the day with IT. A notification on the day the leave date is entered to warn IT of the full notice period to prepare for devices to be returned or for the license to be decided, rather than a last-afternoon frantic rush.
Stage 2: Inventory Snapshot (in the notice period)
Automate: One list for all items that the leaver has access to; laptops, MDM phones, peripherals, SaaS apps, identity provider and app integrations, and any admin roles held in business systems.
Keep manual: Ensuring that items that should not be listed are not, such as a loaner item or a personal purchase item that has been expensed. When carried out throughout the year, an asset survey sent to staff reduces how often this happens.
Why it matters: The inventory is the list. If it's not done, none of the following steps will be done.
Stage 3: Access Removal (last day, or immediately for high-risk exits)
Automate: Disable the user in the Identity Provider. Apps provisioned via SCIM also get deprovisioned when the leaver is deprovisioned, and the MDM can lock or retire the leaver's devices.
Keep manual: Applications other than single sign-on and shared/administrator applications. These require a name and a checklist item, since the identity provider will not delete access it doesn't manage.
Why it matters: Auditors are most concerned with access removal. Also the most likely step to miss "long tail" applications purchased on a credit card.
Stage 4: License Reclaim (last day to two weeks after)
Automate: Flagging each license the leaver held, with its cost and renewal date, so someone can decide whether to reassign, downgrade, or cancel it (see the decision table below).
Keep manual: The decision itself, especially for expensive seats such as design, engineering, or CRM tools, where a replacement hire may need the seat in a few weeks.
Why it matters: A license that's deprovisioned but not canceled still costs money. Reclaiming means getting the seat back into the pool or off the invoice.
Stage 5: Device Recovery (last day to 30 days after)
Automate: Return reminders, shipping label requests for remote staff, status tracking ("awaiting return", "in transit", "received"), and escalation if a device hasn't arrived by a set date.
Keep manual: Chasing a non-responsive leaver and inspecting the condition of returned equipment.
Stage 6: Redeploy, Repair or Dispose (after the device is received)
Automate: Update the asset record with the device's new status, checking warranty and age, and routing it to redeployment, repair, or secure disposal.
Keep manual: Physically wipe or reimage the device, and clear Activation Lock on Apple devices if it wasn't managed through Apple Business Manager. Choose the right Intune action, too: Retire removes company data and management but leaves personal data in place, while Wipe resets the device to factory settings.
Stage 7: Evidence (ongoing)
Automate: A time-stamped log of who did what and when: access removed, licenses reclaimed, devices received, devices wiped or disposed of.
Why it matters: ISO 27001 includes controls on returning assets and removing access rights at termination, and SOC 2 auditors test that leavers' access was removed on time. A clean activity log turns "we think we did that" into a record you can show.
Who Owns What: An Offboarding Responsibility Matrix
Automation works best when every task has a clear owner. This matrix shows a typical split for a mid-market organization. Adjust it to your team, but make sure no row is left without an owner.
| Task | HR / People | IT | Line manager | Finance | Security |
| Enter leave date and exit type | Owns | Notified | Informed | Informed | Notified for high-risk exits |
| Produce the asset and license list | Informed | Owns | Confirms extras | Informed | Informed |
| Deactivate identity and SSO apps | Informed | Owns | Reviews | ||
| Remove non-SSO and admin access | Owns | Hands over ownership of shared accounts | Reviews | ||
| Decide on each paid license | Recommends | Says whether a replacement needs it | Approves cancellations | ||
| Recover devices and peripherals | Includes return terms in exit paperwork | Owns tracking | Chases in-office returns | ||
| Wipe, redeploy or dispose | Owns | Updates asset value | Signs off disposal records | ||
| Keep the audit trail | Owns | Reviews for audits |
The matrix also shows why spreadsheets break down. Five teams touch a single leaver, and each needs to see the same record at the same time.
Recovering Devices from Remote and Hybrid Leavers
In-office leavers hand a laptop over at the desk. Remote leavers are where most hardware is lost, and where a clear process pays off fastest.
Set the expectation before the last day. Include return terms in the offer letter or equipment agreement, and confirm the return method in the exit conversation. Leavers return devices more reliably when they already know how, and by when.
Make returning easy. A prepaid shipping box or a return-service partner removes the most common excuse. Some IT teams use device return services for this. Others send boxes in-house.
Track every step. Record each device's status from "return requested" to "received", with a due date. Automatic reminders at set intervals stop recovery from depending on someone's memory.
Protect the data while you wait. Lock the device through the MDM on the last day, so an unreturned laptop can't be used to access company data. For Apple devices, make sure they're enrolled through Apple Business Manager and supervised, so Activation Lock can be cleared when the device comes back.
Know your escalation path. Agree in advance what happens when a device doesn't come back: who contacts the leaver, at what point it's reported to HR or legal, and when it's written off. Employment law on recovering equipment costs differs by country and state, so check with HR or legal counsel before adding any deduction clause.
Don't forget the small items. Monitors, docks, headsets and keyboards are rarely visible to an MDM. If they're recorded in the asset register against the employee, they appear on the return list automatically.
Reclaiming Licenses: Revoke, Reassign, Downgrade or Cancel?
Removing a leaver's access doesn't save money on its own. Each freed license needs a decision, and the right answer depends on how the vendor bills.
| Situation | Best action | Why |
| A replacement hire starts within a few weeks | Reassign the seat | Avoids buying a new license and paying for both during the overlap |
| The seat is part of an annual contract with a fixed seat count | Return it to the pool and reduce the count at renewal | Most annual contracts don't refund mid-term, but the next renewal can be smaller |
| The vendor bills monthly per active user | Cancel immediately | Every extra billing cycle is wasted spend |
| The team still needs the tool, but at a lower tier | Downgrade the seat | Keeps shared work and files without paying for premium features |
| Files, projects or admin rights belong to the leaver | Transfer ownership, then revoke | Prevents data loss and orphaned admin accounts |
| The tool was only used by the leaver | Cancel the subscription and watch the renewal date | Stops a forgotten tool from auto-renewing next year |
The decision is easier when the license record shows cost, billing model and renewal date next to the leaver's name. Without that, the default becomes "leave it for now", which is how unused seats pile up.
Offboarding Myths that Cost IT teams Money
Myth: "Deactivating Someone in Okta or Entra ID Handles Everything." Reality: The identity provider removes access to connected apps. It doesn't recover hardware; it can't remove access to apps outside single sign-on, and deprovisioning a user doesn't always cancel the paid seat.
Myth: "Our MDM already Tells Us what Devices People Have." Reality: An MDM sees only enrolled devices. Peripherals, phones that were never enrolled, and devices that were wiped or unenrolled won't appear, and the MDM holds no purchase cost or warranty data.
Myth: "Offboarding is an HR process." Reality: HR owns the trigger, but most of the work, and most of the risk, sits with IT. A process designed only around HR paperwork tends to stop at the leave date.
Myth: "We can tidy up Licenses at Renewal Time." Reality: By renewal time, nobody remembers who left, and the cancellation window may already be closed. Reclaiming at exit is far cheaper than an annual clean-up.
Myth: "A Small Company doesn't need an Automated Process." Reality: Volume is only part of the issue. Even at 100 employees, one unreturned laptop holding customer data or one forgotten admin account is enough to fail an audit or a customer security review.
How Setyl Automates Offboarding and Recovery
Setyl is an IT asset and license management platform that connects people, hardware, software licenses, and spend in one place. That makes it a natural hub for offboarding. Offboarding is one of the gaps Setyl was built to close: organizations pay for licenses and lose hardware for people who have already left because no system links the person to what they hold.
The Trigger Comes from Systems You Already Use
Setyl integrates with around 50 HR and people systems, including BambooHR, HiBob, Workday, Personio and ADP, as well as identity providers such as Okta, Microsoft Entra ID, Google Workspace and JumpCloud. When a leave date is added, Setyl notifies IT, moves the employee into an offboarding status, and can trigger the offboarding workflow automatically. Onboarding and offboarding tasks also appear as dashboard reminders, so nothing depends on an email being forwarded.
One Page per Leaver, Built from Live Data
Each employee in Setyl has a record showing every assigned asset, software license, and admin role. Hardware comes from more than 25 asset discovery integrations, including Microsoft Intune, Jamf, Iru (Kandji), Mosyle, NinjaOne and Workspace ONE. Peripherals and non-IT equipment sit in the same register. Software and login activity come from the identity provider, with license details from integrations such as Microsoft, Google Workspace, Adobe, Atlassian, Slack, and Zoom.
During offboarding, that record becomes the checklist: equipment to recover, licenses to revoke or reassign, and admin roles to hand over. Login activity data from connected apps can also surface unregistered subscriptions the leaver used, so you can address them before the next invoice arrives.
Recovery that Keeps the Asset Register Accurate
As devices come back, their status and history update in Setyl, along with warranty data from Apple, Dell, HP, Lenovo, Microsoft and ASUS. That means a returned laptop can be routed to redeployment, repair, or disposal based on its age and warranty, rather than sitting in a cupboard. Role-based permissions let IT hand tasks to office managers, HR or department heads in other locations, with every update recorded centrally.
License Savings that Show up on the Invoice
Setyl flags unused and inactive licenses and warns before renewal notice windows close, which matters most in the weeks after someone leaves. Banked, a Setyl customer, reduced its SaaS spend by more than 25% within two months of setting up its data in Setyl, and Setyl reports that customers can cut IT costs by up to 30%.
An Audit Trail by Default
Activity logs, access control, disposal workflows, and a security audit checklist mapped to ISO 27001 and SOC 2 mean offboarding evidence is collected as the work is done. Teamwork's IT and security lead, Steven Rose, put it this way: "My auditor was blown away when he saw what we are doing with Setyl."
What Setyl is, and Isn't
Setyl orchestrates and records offboarding. It works alongside your MDM and identity provider rather than replacing them, so device wipes still run in Intune or Jamf and account deactivation in Okta or Entra ID. It's also not a service desk, but it integrates with Jira Service Management and Zendesk. Setyl is cloud-based, takes around an hour to set up depending on the company, and is priced by employee count from $300 per month, with unlimited assets and licenses on all plans. It's rated 4.8 on G2 and 4.9 on Capterra, and teams get unlimited one-on-one support by email, chat, and video.
Offboarding KPIs worth Tracking
You can't improve offboarding if you only notice it when something goes wrong. These five measures give IT and Finance a shared view:
Notice lead time: days between the leave date being entered and the last day. Short lead times point to an HR trigger problem.
Time to revoke access: hours between the last day and full deactivation, including non-SSO apps.
Device recovery rate: the share of assigned devices returned within 30 days of the last day.
Licenses reclaimed per leaver: seats reassigned, downgraded, or canceled, plus the monthly value saved.
Checklist completion rate: the share of offboardings closed with every item ticked off and logged.
Reviewing these each quarter shows where the process leaks, and gives IT hard numbers to bring to budget conversations.
FAQ
What should an IT offboarding checklist include?
An IT offboarding checklist should list every device, peripheral, software license, and admin role assigned to the leaver, plus account deactivation, data and ownership transfer, device wipe or retirement, and return tracking. The most reliable checklists are generated automatically from the employee's record, not copied from a template.
How quickly should IT revoke a leaver's access?
For most leavers, access should be removed at the end of their last working day. For dismissals or other high-risk exits, IT should remove access when the employee is told. Building both paths into the workflow avoids improvising on the day.
What if a remote employee doesn't return their laptop?
Lock the device through your MDM so it can't reach company data, keep sending reminders through a tracked process, and escalate to HR according to a policy agreed in advance. Check any steps involving final pay or legal action with HR or legal counsel, since the rules vary by location.
How do you find licenses that aren't connected to single sign-on?
Licenses outside SSO usually surface through expense and finance data, direct vendor integrations, or login activity data from connected apps. An ITAM platform that combines these sources can flag subscriptions tied to a leaver that the identity provider never knew about.
Should returned laptops be wiped or reassigned straight away?
Always wipe or reimage returned laptops before reassignment, using the MDM's wipe action rather than a manual reset. After that, the device's age and warranty status should decide whether it's redeployed, repaired or securely disposed of, with the outcome recorded in the asset register.
Do ISO 27001 and SOC 2 audits check offboarding?
Yes. ISO 27001 includes controls on returning assets and removing access rights when employment ends, and SOC 2 auditors typically sample leavers to confirm access was removed on time. A logged, repeatable offboarding process makes that evidence easy to produce.
About the Author
