How to Automate Employee Offboarding Without Losing the Equipment

Ask an IT team whether they have automated offboarding and most will say yes. Ask them where last year's leavers' laptops are and the answer gets slower.

Both things are true at once. Identity offboarding really has been automated at most organizations, and it works well. Equipment recovery has not been, and the reason is not laziness — it is that the automation depends on a record almost nobody maintains.

What Offboarding Automation Usually Means

When a vendor says it automates employee offboarding, it almost always means the identity half. Microsoft's own scheduled leaver workflow is a fair representative. Its post-offboarding template runs on a schedule after someone's last day and performs three tasks:

1. Remove all licences for the user.
2. Remove the user from all Teams.
3. Delete the user account.

That is genuinely valuable. It reclaims licence spend, closes access, and runs without anyone remembering to file a ticket. It also requires Entra ID Governance or Entra Suite licensing, which is worth knowing before it appears in a plan.

What it does not do — and does not claim to do — is anything about the MacBook, the monitor, the docking station, the phone or the YubiKey. No identity system knows those exist.

The Half That Does Not Get Automated

Identity offboarding is automatable because the identity system is authoritative. It knows every account, every licence and every group, because it issued them. Nothing is missing from its own record.

Equipment offboarding is different. To automate it you need to answer a question no identity system can: what was issued to this person, and is it still with them? That answer lives in an asset system, and its accuracy depends on a list of people that is usually maintained by hand.

This is where the automation stalls. The asset system has a person called "Dave K." who was added in 2023 and never linked to anything. It has two records for the same contractor. It has a name that no longer matches the email address after someone got married. It has forty people who left and were never marked as gone, and their laptops are still assigned to them.

An automated offboarding step that fires against that list produces noise instead of recovery. So teams turn it off and go back to a spreadsheet and a memory.

The People List Is the Actual Blocker

The equipment half of offboarding does not need better checklists. It needs the people list in the asset system to be true.

That is a solvable problem, and it is solvable in one specific way: stop maintaining the list. Read it from the directory that HR and IT already keep current, which for most organizations is Microsoft Entra ID — still widely called Azure AD, and still labelled that way in plenty of documentation.

When People records come from directory groups, several things become reliable at once:

• Names, email addresses, job titles, departments and phone numbers are current because they are the directory's, not a stale copy.
• Somebody who leaves the organization becomes inactive without anyone remembering to do it.
• A person who changes their email address stays attached to the same record and the same equipment history, rather than quietly becoming a second person.
• Duplicate records stop being created, because a directory identity matches an existing person instead of adding another.

Only once that list is trustworthy does an automated question like "show me every asset still assigned to someone who is inactive" return a list worth acting on.

What Automation Should and Should Not Decide

Automating offboarding does not mean the software decides what happens. A few boundaries are worth setting deliberately:

The useful principle is that automation should make unresolved things visible, not quietly resolve them. A laptop that never came back should stay on a list until a person closes it, which is the difference between a system of record and a system that agrees with you.

What to Look For

If you are comparing ways to automate the equipment half, the questions that actually separate the options are narrow:

Where does the people list come from? If the answer is "you maintain it," the automation will decay. Directory sync is the difference between a feature that works in month one and one that works in year three.

What happens to a leaver's history? Records should be marked inactive and kept, with their assignments intact. A system that deletes people destroys the evidence you need at audit.

Does it handle the messy cases? Duplicate people, changed email addresses, contractors in multiple groups, and people who were created manually before the directory was connected. These are the normal state of a real organization, not edge cases.

Does it cover what is not a computer? Monitors, docks, adapters, phones, tools and access cards are most of what goes missing, and none of it appears in an MDM or an identity system.

Is the identity connection read-only? An asset system has no business editing your directory.

How AssetCenter Fits

AssetCenter's Microsoft Entra ID integration reads the directory groups you choose and keeps People records aligned with them. It is read-only: a Microsoft administrator grants consent to read users and group memberships, and AssetCenter never edits your directory.

Directory sync is deliberately separate from Microsoft sign-in. Changing how people log in to AssetCenter is a different setting. Syncing People maintains the records that assets, subscriptions and locations are assigned to, and a synced person does not automatically receive an AssetCenter user account. Keeping those two apart means the asset record can include contractors and staff who never log in at all.

The sync runs automatically and keeps first and last name, email, job title, department, phone number, organization, external guest status, active or inactive status and profile photo current. Somebody whose Microsoft account is disabled is marked inactive. Somebody who leaves every selected group is marked inactive on the next sync. In both cases the record and its assignment history are kept, never deleted — which is exactly what you need when the question months later is who had that monitor.

If an existing person already has the same email address, AssetCenter links that record rather than creating a second one, and future syncs follow the directory identity so a later email change still updates the right person. Where genuine duplicates already exist, they can be merged from the People list. The directory sync manual covers connecting, choosing groups and what each sync updates.

With the people list current, the equipment half becomes ordinary work: a leaver is already inactive, their assigned assets are already visible, and the recovery process has something reliable to run against. Our employee offboarding equipment checklist covers that process step by step, and IT asset lifecycle management sets out the owners and evidence for each handoff across the whole lifecycle.

Start With the List

Automating offboarding in the right order matters. Most teams start with the recovery workflow and discover it runs against bad data. Starting with the people list is less satisfying and considerably more effective.

A practical sequence:

1. Connect the directory and choose the groups that represent staff and contractors.
2. Let the first sync run, then merge any duplicate people it surfaces.
3. Review every asset assigned to someone now marked inactive. This is usually the moment the real backlog appears.
4. Work that backlog once, deliberately.
5. Only then automate the recurring steps, because from that point the exceptions are real ones.

Identity offboarding was automated because the identity system knew its own record. The equipment half becomes automatable for the same reason, as soon as the asset system knows who actually works there. AssetCenter for IT teams covers what that record holds once it does, and how equipment, people, subscriptions and locations stay connected on one timeline.

If you want the broader context first, what IT asset management is explains the system of record this depends on.

By Jeremy Francis

Founder & CEO, AssetCenter