跳到主要內容

085: Offboarding Devices

Implementation Effort: Medium
User Impact: High

Overview​

Offboarding is the controlled removal of a device from access to organizational data and management. It may be triggered by employee exit, role change, lost or stolen hardware, device replacement, contract end, or a decision to stop allowing a BYOD device to access work resources. Zero Trust offboarding is not only an Intune action. It should combine device management actions, identity session revocation, app access removal, and record cleanup so a device no longer has residual trust after it leaves scope.

Implementation Guidance​

  1. Classify devices by ownership first. Personally owned devices usually call for retire or selective removal of work data, while lost or reassigned corporate-owned devices may require wipe or full reprovisioning.
  2. Define which Intune action is appropriate for each event type: retire, wipe, delete record, sync before action, or collect diagnostics before removal if an investigation is underway.
  3. Coordinate Intune offboarding with Microsoft Entra actions such as disabling the account, revoking refresh tokens, removing group membership, and invalidating app access where required.
  4. Remove dependent access paths such as certificates, Wi-Fi/VPN profiles, and app assignments so the device cannot continue reaching corporate resources through cached or residual configuration.
  5. Keep an auditable runbook for HR exits, lost-device incidents, and contractor end dates so help desk and security operations use the same process.
  6. After offboarding, verify that the device record, ownership state, and any automated enrollment artifacts are cleaned up or intentionally retained according to policy.

Reference​