# Employee Offboarding Workflow: The Enterprise Kill-Chain

In a global enterprise environment, employee turnover is a high-frequency event that presents a critical **“Insider Threat”** risk. If offboarding is not handled with precision, former employees may retain access to sensitive SaaS applications, local files, or internal network segments.

Hexnode UEM automates this transition by synchronizing **Cloud Identity Providers** with our **MQTT Triple-Channel Engine**. This ensures that the moment an employee is terminated in HR, their devices are immobilized, data is sanitized, and hardware is prepared for secure decommissioning or refresh.

**Logical Architecture: The Offboarding Workflow**
--------------------------------------------------

The offboarding engine operates as a high-priority “Kill-Chain” triggered by external identity signals:

- **The Ingress Signal:** Hexnode monitors the **SCIM 2.0** feed from Entra ID (formerly Azure AD), Okta, or Google Workspace. A status change to active: false or the removal of a user from a “Managed” group triggers the workflow.
- **The Signaling Plane:** The orchestrator dispatches a **“Priority 0”** decommissioning payload via the **MQTT Socket (Port 8883)**, bypassing standard polling queues for near-instant execution.
- **The Data Sanitizer:** The Hexnode Agent (HWA/HMA/HLA) executes the **Wipe** command. Depending on the ownership model (BYOD vs. Corporate), this targets specific **Secure Containers** or performs a full **NIST 800-88** compliant OS-native sanitization.
- **The Handover Logic:** For high-value roles, the system can trigger an automated **“Forensic Archive,”** streaming encrypted local work data to a manager’s Managed Cloud before the local wipe is finalized.

**Tiered Offboarding Profiles**
-------------------------------

Hexnode utilizes attribute-based mapping to determine the severity and type of offboarding required.

### **1. Graceful Departure (Standard Resignation)**

- **Identity Trigger:** HR status updated to **Terminated – Notice Given**.
- **Action:** Hexnode schedules a **“Management Withdrawal”** for the user’s last day at a predefined local time.
- **User Impact:** Access to the **App Store** is restricted to prevent bulk software or data downloads before departure.

### **2. High-Risk Departure (Immediate Termination)**

- **Identity Trigger:** HR status updated to **Terminated – Immediate** or **Security Incident**.
- **Action:** **Instant Fleet Decapitation.** The device is hard-locked at the firmware level. All active SSO sessions are revoked via Hexnode Access. A full hardware wipe is initiated in **< 1.0 second** via the MQTT socket.
- **Data Gate:** Local files are encrypted with a new, randomized key that is never escrowed, rendering the data unrecoverable instantly.

### **3. BYOD / Contractor Withdrawal**

- **Identity Trigger:** User removed from the “Active Contractors” IdP group.
- **Action:** **Selective Wipe.** Hexnode purges only the managed business partition, corporate certificates, managed apps, and VPN profiles. Personal user data (photos, personal emails) remains untouched to satisfy regional privacy laws (GDPR/CCPA).

**Execution Logic: The 4-Phase Sanitization Loop**
--------------------------------------------------

### **Phase 1: Identity Revocation & Gating**

The orchestrator receives the termination signal from the IdP.

- **Immediate Action:** Update the **Real-Time Compliance Gate** to “Revoked.”.
- **Handshake:** Hexnode dispatches a signal to the corporate **Network Access Control (NAC)** to terminate all active Wi-Fi and VPN sessions.

### **Phase 2: Secure Data Offloading**

For Executive or R&D roles, the Agent performs a final sync of the Secure Container.

- **Mechanism:** Work documents are zipped into an **AES-256** encrypted package.
- **Fulfillment:** The package is streamed to regional storage, and a **SHA-256 manifest** is generated for audit.

### **Phase 3: Hardware Immobilization**

The device enters the “Terminal State” via the MQTT channel:

- **LAPS Rotation:** The **Local Admin Password Solution (LAPS)** rotates the local admin password to a 128-character string, preventing unauthorized local login.
- **OS-Native Sanitization:**
    - **macOS:** Triggers **“Erase All Content and Settings” (EACS)** for T2/Apple Silicon chips.
    - **Windows:** Executes a **“Reset this PC”** with data overwrite flags.
    - **Android/iOS:** Triggers a hardware-level **Factory Reset**.

### **Phase 4: Audit Closure & Logistics**

- **Audit Entry:** A **“Certificate of Sanitization”** is generated, documenting the Serial Number, Timestamp, and NIST method used.
- **Logistics:** A webhook triggers the shipping of a return box to the user’s address via a logistics partner.

**Scale Impact & ROI (500k Fleet)**
---------------------------------------

Metric**Manual Offboarding**Hexnode Automated Sanitization**Revocation Latency**4 – 24 Hours **< 1.0 Second** **Data Leakage Risk**High (Residual Files) **Zero (Verified Crypto-Purge)** **Technician Workload**60 Mins / User **0 Mins (Autonomous)** **Compliance Accuracy**~85% (Human error) **100% (SCIM Triggered)** **Governance & “Legal Hold” Conflict**
------------------------------------------

If a device is subject to an active **Legal Hold**, the offboarding logic is automatically overridden:

- **Conflict Logic:** The “Forensic Preservation” flag always takes precedence over “Sanitization.”.
- **Resolution:** The device is **not wiped**. It is immobilized in a “Forensic Freeze” state to preserve evidence for discovery.