VPN employee offboarding is the process of removing a departing worker’s remote access to a company network, and it is one of the simplest ways to close a security gap. When someone leaves, their VPN account can remain active long after their last day.
A virtual private network, or VPN, creates an encrypted tunnel between a laptop or phone and an office network over the public internet. Anyone holding valid credentials can use that tunnel from almost anywhere. For this reason, every former employee’s access must be identified, reviewed, and cut off on a defined schedule.
Why a Forgotten VPN Account Becomes a Real Risk
Consider a hypothetical sales representative who leaves a company on a Friday. Her laptop is returned, but her VPN username and password still work on her personal phone.
Nobody notices until an unusual login appears weeks later from a country she never visited. The account was never the problem on its own; the gap was the missing step in the exit process.
Stale accounts are attractive to attackers because they often hold the same permissions they had on the last working day. Credentials may also have been reused across other services, or stored in a browser on a shared device. Without a clear removal step, these accounts can linger unnoticed.
The risk is not limited to malicious intent. A former employee might simply keep a saved profile and connect out of habit, exposing shared files to a device the company no longer controls. Prompt removal removes both the deliberate and the accidental pathways.
Core Principles That Guide a Sound Offboarding Process
The first principle is timeliness. Access should end at or before the moment employment ends, not days afterward. Many organizations tie VPN removal to the same trigger as payroll and building badge deactivation so that no single step depends on memory.
The second principle is completeness. A VPN account is rarely the only credential a worker holds. Remote access may rely on a directory login, a certificate issued to a laptop, a one-time code app, or shared keys. Each of these needs to be mapped so nothing is missed.
The third principle is verifiability. The organization should be able to show, through logs or a checklist signed by the manager, that access was removed and when. Written evidence makes audits easier and reveals gaps early.
A Practical Offboarding Checklist for VPN Access
A repeatable checklist keeps the process consistent across departments and reduces reliance on any one administrator. The steps below can be adapted to most organizations regardless of the VPN product in use.
- Disable the user’s directory account so that VPN logins relying on it fail immediately.
- Revoke or expire any client certificates or pre-shared keys assigned to the person’s devices.
- Remove the user from VPN access groups and any policies that grant network segments.
- Review active sessions and terminate any connections still open at the time of departure.
- Confirm that multi-factor authentication devices tied to the account are unenrolled or reassigned.
Each step should be assigned to a named owner and checked off in a shared record. Running the list on the final working day, and again a few days later, catches accounts that were missed. Keeping this checklist as a living document lets the team update it when the environment changes.
Handling Edge Cases Like Shared Accounts and Devices
Not every offboarding is straightforward. Shared credentials, company-owned devices, and contractors who work through third parties each require extra attention. Planning for these situations in advance prevents rushed decisions when a departure arrives unexpectedly.
Shared Accounts and Group Credentials
Some teams share a single VPN login for convenience, which makes it impossible to remove one person without affecting others. The better approach is to issue individual accounts so each person’s access can be ended independently. Where a shared account must remain, rotate its password whenever a member leaves.
Hypothetically, if a shared login for a support team is changed without notice, colleagues may be locked out during working hours. Communicating the change in advance and scheduling it for a quiet period reduces disruption.
Document every shared account in an inventory so that departures trigger a review of which credentials the person knew. This makes it clear what must be rotated and who needs the new details.
Company Devices and Personal Devices
When an employee used a company laptop for VPN access, retrieving the device is part of the process. The device should be checked for stored VPN profiles, saved passwords, and client certificates before it is reissued. Wiping and reimaging the machine is a common practice that removes residual configuration.
Personal devices require a different approach because the company does not control them. Removing the VPN profile from the device, and revoking the certificate or token tied to it, is usually the most reliable step. Written guidance on this should appear in the acceptable use policy so expectations are clear from the start.
Mobile device management tools, where used, can remove corporate VPN profiles remotely. Whatever the method, the outcome should be confirmed rather than assumed.
Contractors, Vendors and Temporary Staff
Outside workers often receive access under contracts that end on a fixed date. Recording that end date at the time access is granted allows the removal to be scheduled automatically or reviewed on time. Waiting for someone to remember the contract expired is a frequent cause of lingering access.
If a contractor’s company supplies the people doing the work, the supplier’s offboarding obligations should be written into the agreement. The organization still needs to verify that access was revoked rather than relying on the supplier’s word alone.
Temporary accounts should carry an expiry setting wherever the VPN platform allows it. Expiry settings provide a safety net if the manual step is forgotten.
Why Logging and Monitoring Matter After a Departure
Removing access is only half the job. Monitoring what happens in the period around a departure shows whether the process worked. Connection logs can reveal attempts to sign in with a disabled account, which may point to a missed step or to someone trying to return.
Logs should record who signed in, from what address, at what time, and which resources were reached. Retaining these records for a defined period, consistent with company policy and applicable law, gives investigators something to review if questions arise later. Limiting who can read the logs protects the privacy of the people they describe.
Alerts can be set for failed logins against accounts that should be inactive. A single failed attempt may be harmless, but a pattern across several days deserves attention. Reviewing these alerts is a short task that often catches problems early.
Common Mistakes That Undermine Offboarding
Even well-intentioned teams make predictable errors. Recognizing them is the first step toward avoiding them in your own organization. The following mistakes appear often in reviews of access processes.
- Relying on a manager’s email instead of a standard form that triggers each removal step.
- Disabling the directory account but forgetting certificates, tokens, or second-factor devices.
- Waiting until the end of the month to batch removals rather than acting on the last day.
- Failing to review group memberships, so access granted for a past project remains in place.
- Assuming a laptop return ends access, when the VPN profile may still work on other devices.
Avoiding these mistakes usually comes down to clear ownership and a single trigger for the whole process. When HR records a departure, the same notice should start the IT removal steps, with dates and names attached. Periodic audits of active VPN accounts against the current staff list help catch anything the trigger missed.
Building an Offboarding Routine That Lasts
A durable routine begins with a written procedure that names owners, timelines, and evidence requirements. The procedure should be short enough that managers actually read it and specific enough that IT can follow it without guessing. Reviewing it once a year, or after any significant change to the VPN platform, keeps it accurate.
Training matters as much as documentation. Managers should understand why they must report departures promptly, and staff should know that their own devices may need to be cleaned up when they leave. Brief, clear explanations tend to produce better compliance than lengthy policy documents.
Looking ahead, many organizations are moving toward automated lifecycle tools that connect HR systems to access management. Whatever tools you choose, the goal stays the same: access should end as soon as the business reason for it ends, and you should be able to prove it did.