how to revoke vpn access on termination day
Revokes VPN access immediately on employee termination. Covers group removal, session kill, certificate revocation, and verification. Use on termination day. Not for planned access changes.
TL;DR
Remove the user from the VPN authorization groups, kill active VPN sessions on the gateway, and revoke any client certificates. Then verify by checking the gateway logs for the user. Do this as part of the offboarding runbook, not as an afterthought.
The error
(Urgent offboarding step; no error.)Steps
- Remove the user from all VPN authorization groups in AD/Entra. Expected: group membership gone. This stops new connections at next auth.
- Kill active sessions: on the gateway admin console, find the user's session and terminate it. Expected: session gone. Group removal alone does not drop an established tunnel.
- If the VPN uses certificates, revoke the user's client certificate at the CA and publish the CRL. Expected: revoked. A valid cert can re-auth depending on gateway config.
- Disable or delete the VPN client profile on the user's device if you have MDM control. Expected: profile removed. This is hygiene; steps 1-3 are the enforcement.
- Verify: check gateway logs for any connection attempts by the user after revocation. Expected: none, or rejected attempts. Rejected attempts confirm the revocation is working.
When to use
- Employee termination (voluntary or involuntary)
- Contractor end date reached
When not to use
- Temporary VPN suspension (use session kill only)
- Changing VPN groups for an active employee
Compatibility
- Any VPN with group-based authorization; gateway session management
Variants
Involuntary termination
Do steps 1-3 before notifying the employee, coordinated with HR and security.
Shared VPN credentials (bad practice)
If the org used shared credentials, rotate them immediately; revoking one user does nothing.
Why it happens
VPN is remote network access, the highest-risk access to leave lingering. Sessions persist past group removal and certs persist past account disable, so all three must be handled.
Edge cases
- Always-on VPN clients retry aggressively; watch the logs for retry storms and confirm they are rejected.
- Document the revocation time for compliance.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstiRig8cH2BtPONf23GcqlA
Maintainer review
No maintainer verification is recorded for this version.
This records the version a maintainer checked. It does not assert that the version is the latest upstream release.