The Importance of Properly Offboarding Employees<\/p>\n\n\n\n
Employers and their employees part ways for all sorts of reasons. People may move on because of a contract\u2019s completion, to take a new job, or because they\u2019re retiring. Employees may also leave due to being laid off or fired. Whatever the reason, offboarding\u2014the process of managing an employee\u2019s departure from an organization\u2014is essential. <\/p>\n\n\n\n
Without a systematic offboarding protocol, organizations face significant risks related to data security, device mismanagement, operational disruptions, and compliance violations. In a particularly troubling example, a fired employee allegedly hacked Disney World\u2019s menu creation system<\/a>, changing prices, adding profanity, and\u2014most problematically\u2014adjusting allergen information in ways that could have caused someone allergic to peanuts to order food that contained them.<\/p>\n\n\n\n Obviously, offboarding has various administrative aspects. We\u2019ll focus on those associated with technical infrastructure, but it\u2019s also important to consider how you\u2019ll communicate internally about the departure and any human resources and legal matters.<\/p>\n\n\n\n Our overarching advice regarding offboarding is to establish a formal protocol so everyone knows what\u2019s involved. That\u2019s particularly important for departures that happen with little notice. When building your offboarding plan, consider these three parts of the process: revoking access, retrieving devices, and preserving the organization\u2019s data.<\/p>\n\n\n\n When offboarding an employee, the most important thing to consider is how you\u2019ll revoke their digital access to organizational resources such as email, a shared password manager, and core service accounts. For those who are retiring or staying to train their replacement, access revocation can proceed gradually on a schedule. This approach provides sufficient time to transition ongoing projects and communications.<\/p>\n\n\n\n However, in most cases, it\u2019s safest to revoke access immediately, especially when an employee has been terminated involuntarily due to layoffs, performance problems, or misconduct, or when dealing with employees in high-security roles, such as IT administrators, members of the legal team, or high-ranking executives. Even if their departure isn\u2019t contentious, the risk of data leakage is too high.<\/p>\n\n\n\n Revoking access is significantly easier if you\u2019re using Apple Business Manager and an MDM platform. Because Apple Business Manager lets you use federated Apple Accounts, it\u2019s simple to revoke access to iCloud and other Apple services. Plus, because Apple Business Manager makes it possible to separate personal Apple Accounts and their associated data, employees can move their personal data off an organization\u2019s device more easily. <\/p>\n\n\n\n MDM\u2014mobile device management\u2014is even more important because it enables administrators to revoke access to organization-managed email accounts, VPNs, Wi-Fi networks, and cloud services. If a device isn\u2019t returned, an MDM platform can remotely lock, wipe, or reset it. For BYOD scenarios (Bring Your Own Device, where employees use their own devices rather than organization-owned ones), a properly configured MDM allows the removal of organizational data and profiles without affecting personal data.<\/p>\n\n\n\n Using an identity provider like Google Workspace, Microsoft Entra ID, or Okta with a single sign-on system makes revoking access even more straightforward. These services tie access to an organization\u2019s apps, resources, and devices to a single login, so deactivating a departing employee\u2019s account in the identity provider instantly cuts off access to all connected systems. Otherwise, you\u2019ll find yourself doing the dance of deactivating Google, then Adobe, then Slack, and so on. It\u2019s tedious and potentially error-prone.<\/p>\n\n\n\n Finally, the combination of an MDM system with single sign-on can also help monitor employee behavior during the offboarding period for unusual activities. You\u2019ll want to know if a terminated employee logs in to a confidential database that they have no reason to access immediately after receiving notice. <\/p>\n\n\n\n Another key aspect of your offboarding plan should revolve around retrieving organization-owned devices. Even if you can use MDM to revoke access, you need to get your devices back so they can be given to other employees or held in reserve as backups. Apple Business Manager helps here, too, since it tracks all registered devices owned by the organization and can reassign devices to new users.<\/p>\n\n\n\nRevoke Digital Access<\/h3>\n\n\n\n
Retrieve Organization Devices<\/h3>\n\n\n\n