Offboarding: RMM and AV removal checklist

Overview

Scope: your agents and overlapping third-party tools. Incomplete uninstall triggers duplicate alerting, license billing fights, and data leakage accusations.

RMM

Revoke API keys in vendor portal; uninstall via script or vendor package; verify no remote access listeners remain; remove firewall allow rules for old NOC IPs.

AV/EDR

Ensure MDE offboarding scripts or vendor removal tool runs; confirm no stale devices in tenant portal consuming seats.

Audits

Export agent inventory CSV before and after with timestamps; attach to PSA for disputes.

Physical

Factory reset NOC jump boxes or VoIP ATAs you owned—legal chain of custody form.

Confirmation email template

“We removed X as of timestamp UTC; please confirm no other agents expected.” Get reply in ticket.

Security

Assume hostile breakup—change all shared passwords MSP used regardless of politeness.