Skip to main content

011: Offboarding Strategy

Implementation Effort: Medium – Requires coordination across identity, endpoint, HR, and security operations processes.

User Impact: Medium – Offboarded users lose access and may see device retirement, selective wipe, or account restrictions depending on device ownership and app model.

Overview​

Offboarding in Microsoft Intune is not just deleting a user account. A complete process must address user identity, enrolled devices, managed apps, app protection data, administrative role assignments, and access revocation timing. In Zero Trust, the goal is to remove access quickly while preserving the right level of data protection and auditability for corporate-owned and personally owned devices.

Implementation Guidance​

  1. Start with identity controls: disable sign-in or otherwise block access according to HR and security process before final deletion. This prevents new session activity while device cleanup proceeds.
  2. Review the user’s enrolled and associated devices. For corporate-owned devices, decide whether to retire, wipe, or reassign. For BYOD or MAM-only scenarios, use selective wipe or access revocation where appropriate.
  3. Remove the user from privileged admin groups and any Microsoft Entra or Intune role assignments immediately if they held administrative access.
  4. Review enrollment restrictions, device enrollment manager associations, Apple or Android ownership constructs, and any shared device dependencies so the offboarding action does not unintentionally affect other users or staged devices.
  5. Verify that app protection access is revoked and that managed apps can no longer access work data after the user is disabled or removed from targeting groups.
  6. Document who owns the final validation step: identity team, endpoint team, or security operations. Incomplete offboarding often happens when each team assumes another team finished the job.

Reference​