Meeting Disruption with Automation: A Major Retailer’s Offboarding Transformation

98%
successful endpoint
recovery

96%
time reduction for
complete access revocation

100%
compliance with CIS/NIST
framework despite disruptive
workforce reduction

About the Retailer

As a leader in the "do-it-yourself" home improvement market, this major retailer is
committed to providing excellent service. With a
focus on its customers, supply chain, and
technology, it offers design services, expert
advice, and competitive prices. The company has
invested heavily in technology to improve
efficiency, including the systems and tools needed
to manage its IT environment across hundreds of
locations.

Business Profile

Industry:
Retail

Employees:
31,000+ full-time and
part-time

Annual Revenue:
$11 billion (2024)

Endpoints:
55,000+ endpoints

SaaS apps:
200+ IT managed
and unmanaged

Infrastructure:
Multi-cloud

Making Offboarding and Asset Recovery Effortless

When economic challenges led to the reduction of thousands of roles, a major home improvement retailer needed to reclaim thousands of IT assets from departing employees. Due to the urgency, most offboarding tasks were often accomplished manually with little coordination between systems. With this type of company environment, these tasks were presenting immense overhead for their IT department, who had been impacted by a restructuring.

Instead of placing the burden on their IT staff, the retailer leaned into their technology investment. They extended their existing use of Oomnitza to automate their secure employee offboarding process, transforming what would have been a logistical and security nightmare into a streamlined, secure, and compliant process.

Within 10 days, the Oomnitza-powered “Separation-to-Recovery” workflow was live, delivering significant cost savings, resource efficiency, and peace of mind. In doing so, they were able to:

• Quickly and completely revoke access to systems, applications, SaaS, and cloud resources
• Catalog all cloud resources per employee to reduce the likelihood of orphaned instances
• Execute a plan to recover thousands of devices
• Determine what systems and applications might have work in progress and transfer ownership to manager or other peers to ensure business continuity
• Establish a new baseline of required software and SaaS licenses for vendor renegotiation

The Retailer’s Environment:

• Microsoft Intune for endpoint management
• Tanium for endpoint management
• CrowdStrike for endpoint security
• Meraki for network infrastructure management
• Google Workspace on all Android devices
• Jamf Pro on all Mac and iOS mobile devices
• CDW relationship for procurement
• Okta for single sign-on
• ServiceNow for service management and ticketing
• Workday for human resource management

Scaling Secure Offboarding During a Storm

Urgency Meets Complexity

The speed required from the retailer during a time of urgency made traditional, manual offboarding untenable. With thousands of employees exiting, rapid, secure, and coordinated action was critical. Each offboarding typically involved 40+ manual steps per employee—more than the lean IT team could sustain at the moment.

Security Risks and Access Blind Spots

Manual offboarding left orphaned accounts in systems, SaaS, and cloud, expanding the attack surface. They required immediate, automated deprovisioning plus a safe handoff of cloud assets and active work.

Device and License Recovery at Scale

Recovering laptops, mobile devices, licenses, and applications at this scale was demanding. Beyond retrieval, the retailer needed visibility into what could be reassigned, renegotiated, or decommissioned to minimize financial spend.

Maintaining Compliance Under Pressure

Amid this operational stress, compliance with the CIS and NIST security frameworks wasn’t optional. It didn’t matter that they were in the middle of disruptive workforce reduction. The home improvement retailer had to meet their security and audit obligations.

Challenges

The retailer had already invested in and deployed Oomnitza’s IT Asset Management (ITAM) solution to manage the lifecycle of their hardware, software, and virtual technology assets.

When macroeconomic factors and softness in the retail market forced them to reduce their workforce by several thousand full and part-time workers, the sudden restructuring brought up several challenges related to securely offboarding employees in an efficient, compliant, and financially sound manner.

The retailer needed to recover thousands of IT assets and SaaS licenses.

Device and License Recovery

There were 40+ manual touchpoints and help desk tickets required per departing employee. Without recovering the devices, the retailer faced mounting security and compliance risks.

The Retailer’s Secure Offboarding Process with Oomnitza

Separation

Integration with Workday to automatically activate a workflow in Oomnitza once there is a pending change to employee’s status in the HR system.

Recovery

Automatically send confidential notifications to stakeholders including IT, finance, legal, and department heads with an inventory of all equipment assigned to the employee and the systems they have access to.

Deprovision

On separation day, lock a variety of assigned laptops and mobile devices (HP, Lenovo, Dell, Apple, Microsoft, and more) to restrict access to proprietary data through integration with Jamf and Tanium.

Turn off access to SSO-managed SaaS applications via integration with the Okta Identity Engine.

Reassignment

Remove access to Amazon Web Services as well as other applications that are provisioned without Okta through direct integration. Ensure work product in systems such as Google Workspace, Salesforce, AWS, and other services is transferred to employee’s manager or other designated peer for business continuity. Auto-forward inbound emails for former employees to a manager or other mailbox, delete recurring invites.

Recovery

Automatically send a prepaid shipping label to the former employee for return of their assigned endpoints via integration with FedEx tracking.

Recover software licenses for either reuse by another employee or to renegotiate vendor agreements.

Decommission/Reallocation

Automatically assign endpoints to either the reallocation pool or send for end-of-life processing based on warranty date. Wipe device, update the asset registry, and return to inventory or label it for e-cycle/disposal in the fixed asset register.

Testimonial

The team at Oomnitza helped us automate the S2R ‘zero touch’ secure offboarding process. As a result, we were able to recover a high volume of employee issued endpoints, as well as dramatically reduce the risk of unauthorized access to company systems and data. I highly recommend Oomnitza for anyone looking to streamline and secure their IT offboarding process.

Vice President, IT Services, Major Home Improvement Retailer

Automation That Delivered

Immediate Results

The retailer reached out to the Oomnitza Customer Success team for assistance. After reviewing requirements, the Oomnitza team recommended the Separation to Recovery (S2R) Secure Offboarding Process, which was fully implemented within 10 business days.

The retailer leaned on Oomnitza’s powerful low-code workflow engine to deploy the S2R process and automate repetitive, manual and error-prone tasks. By leveraging the flexibility and expandability of the solution, the company was able to quickly pivot their business in response to external economic and market conditions.

The results were almost immediate.

The retailer was now able to process a large number of offboarding employees, with little or no manual interaction. Not only did they successfully recover most of the employee assigned endpoints, but they also achieved security framework compliance and protected company data from unauthorized access.

As a result of expanding their use of Oomnitza, the retailer was able to realize significant cost savings, security improvements, and IT efficiencies.

Major Cost Savings

Thanks to Oomnitza, the home improvement retailer successfully reclaimed 98% of endpoints from departing employees. This by itself achieved savings of several million dollars.

The Outcomes

The retailer partnered with Oomnitza to expand their use case to rapidly deploy and automate the Separation-to-Recovery (S2R) Secure Offboarding Process. In doing so, they:

• Deployed a zero-touch, automated offboarding process in just 10 days
• Reclaimed 98% of endpoints from departing employees
• Saved millions through reclaimed assets and licenses
• Achieved 100% compliance with CIS/NIST frameworks

Massive Time and Resource Efficiencies

As the extensive number of manual processes for offboarding thousands of employees was reduced, their IT team was able to save hundreds of hours per month and keep their scarce IT resources focused on business-critical projects.

Security Improvements

The completion time to remove access to key systems for departing employees as a result of using the automated S2R process was reduced to a few minutes, and they were able to achieve compliance with CIS and NIST frameworks. This dramatically reduced the risk of proprietary data exposure to unauthorized persons.

Zero-Touch Automation:

The retailer extended automation all the way from technology lifecycle management to secure employee offboarding, eliminating 40+ manual touchpoints and converting help desk tickets into a zero-touch workflow.