If you manage a hybrid IT environment, you already know the dread of the “Employee Offboarding” ticket.
It sounds simple on paper. In reality? It’s a disjointed, frustrating scavenger hunt. You find yourself logging into an on-premises Domain Controller to disable the user and move to a different OU. Then you hop over to the Exchange Admin Center to convert the mailbox. Next, you jump into the Microsoft Entra portal to revoke refresh tokens, wipe MFA methods, and strip licenses. Finally, you head to the SharePoint Admin Center to handle their OneDrive data.
It easily takes 30 minutes of manual clicking per user. It is repetitive and prone to human error. If you miss just one step, you leave a massive security gap wide open. But there had to be a better way, right? This comprehensive guide walks you through building a resilient, zero-touch offboarding pipeline!
The Architecture of Automated Offboarding Engine
Before we look at the commands, let’s look at the operational flow.
- Trigger Initialized: An HR system or helpdesk agent drops a plain .txt file containing the target user’s email into C:\EasyEntra\Offboarding\Input\.
- Automation Polling: Windows Task Scheduler wakes up on a recurring frequency and launches the background engine under the service account profile.
- EasyEntra Processing: The script reads the username and executes Invoke-EEDecommissionHybridUser to modify local Active Directory and Cloud Entra ID simultaneously.
- Success Path: Successfully processed text files are cleanly migrated out of the queue and stored inside C:\EasyEntra\Offboarding\Done\.
- Failure Path: Broken files or unrecognized identities are quarantined inside C:\EasyEntra\Offboarding\Error\, while the system writes the exact error code to C:\EasyEntra\Offboarding\Logs\.
To make this completely secure and automated, do not use personal administrator account. Let’s begin by creating and configuring the service account required for the offboarding automation.
Step 1: Create the Service Account (Active Directory & Entra ID)
To run unattended background tasks safely, you must establish a dedicated identity with the exact minimum permissions required.
1. On-Premises Active Directory Setup
- Open Active Directory Users and Computers (dsa.msc) or EasyEntra.
- Navigate to your managed Service Accounts Organisational Unit (OU).
- Create a new user account named svc.EEAutomation.
- Set a strong password, check Password never expires, and clear User must change password at next logon.
To trigger synchronization immediately, click the Entra Connect delta synchronization button in EasyEntra to invoke synchronization of Entra ID from AD.
After the service account creation,
- Open Local Security Policy (secpol.msc) on the machine running the automation script.
- Navigate to Local Policies > User Rights Assignment > Log on as a batch job.
- Click Add User or Group…, add svc.EEAutomation, and save changes.
2. Microsoft Entra ID Cloud Setup
- Log into the Microsoft Entra Admin Center as a Global Administrator.
- Ensure the hybrid identity for svc.EEAutomation has synced cleanly from your on-premises AD via Microsoft Entra Connect.
Step 2: Establish the File Trigger Folder Structure
The automation requires a dedicated workspace directory on the local C: drive of your management execution machine to process job lifecycles. Ensure the dedicated service account has read and write access to all workspace folders so it can process, update, and move job files as required.
Create the following nested directories exactly as shown below:
- C:\EasyEntra\Scripts\ – Houses the production automation script.
- C:\EasyEntra\Offboarding\Input\ – The Trigger Folder where files are dumped to start an offboarding.
- C:\EasyEntra\Offboarding\Done\ – The storage vault where successfully processed files automatically migrate.
- C:\EasyEntra\Offboarding\Error\ – The quarantine area where files with structural or user errors are safely isolated.
- C:\EasyEntra\Offboarding\Logs\ – Contains chronological daily activity tracking logs for audit trails.
Step 3: Deploy the Core Offboarding Automation Script
Save the following optimized, script as Run-EasyEntraOffboarding.ps1 inside C:\EasyEntra\Scripts\.
$InputFolder = "C:\EasyEntra\Offboarding\Input"
$DoneFolder = "C:\EasyEntra\Offboarding\Done"
$ErrorFolder = "C:\EasyEntra\Offboarding\Error"
$LogFolder = "C:\EasyEntra\Offboarding\Logs"
$LogFile = Join-Path $LogFolder "Offboarding-$(Get-Date -Format 'yyyy-MM-ddTHH-mm-ss').log"
function Write-Log {
param([string]$Message)
"$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') $Message" |
Out-File -FilePath $LogFile -Append -Encoding UTF8
}
Write-Log "Script launched..."
Import-Module "C:\Program Files\PowerShell\7\Modules\EasyEntraPS\EasyEntraPS.psd1" -Force
Write-Log "Exported: $((Get-Module -ListAvailable EasyEntraPS).ExportedCommands.Keys -join ', ')"
$Files = Get-ChildItem -Path $InputFolder -File -Filter "*.txt"
foreach ($File in $Files) {
try {
$Identity = (Get-Content $File.FullName -Raw).Trim()
if ([string]::IsNullOrWhiteSpace($Identity)) {
throw "Trigger file is empty."
}
Write-Log "Starting offboarding for $Identity from file $($File.Name)"
$Result = Invoke-EEDecommissionHybridUser `
-Identity $Identity `
-Confirm:$false
# FIXED LINE BELOW: Isolate $Identity from the colon
Write-Log "Status for ${Identity}: $($Result.Status)"
if ($Result.TaskLog) {
foreach ($Entry in $Result.TaskLog) {
Write-Log "[$($Entry.Status)] $($Entry.Task) $($Entry.Message)"
}
}
if ($Result.Status -eq "FatalError") {
throw "EasyEntra returned FatalError for $Identity"
}
Move-Item $File.FullName -Destination (Join-Path $DoneFolder $File.Name) -Force
Write-Log "Moved $($File.Name) to Done."
}
catch {
Write-Log "ERROR processing $($File.Name): $_"
Move-Item $File.FullName -Destination (Join-Path $ErrorFolder $File.Name) -Force
}
}Step 4: Interactive Setup & EasyEntra Profile Authentication
EasyEntra stores its connection profile configuration within the current user’s profile folder. Because of this, you must perform the initial configuration and authentication while logged in as the dedicated service account (svc.EEAutomation) that will later run the automation.
- Open a PowerShell 7 terminal and change your working directory:
cd “C:\Program Files\EasyEntra” - Execute the graphical configuration application: .\EasyEntra.exe
- Log into service account created above (svc.EEAutomation).
After configuring PowerShell with the service account, open EasyEntra application.
- Open Connection Manager and select AD Connections > Click Add New.
- Complete the interactive authentication login using the credentials for svc.EEAutomation.
Step 5: Configure the Task Schedular to Automate Offboarding PowerShell Script
To ensure the script loops, checks for files, and executes in the proper profile context, map it inside Windows Task Scheduler.
- Open Task Scheduler (taskschd.msc).
- Right-click and choose Create Task.
- Under the General Tab:
- Name: EE User Offboarding
- Click Change User or Group and change the executing account to svc.EEAutomation.
- Toggle Run whether user is logged on or not.
- Check Run with highest privileges.
Now, configure the below under the Triggers Tab. Click New.
- Begin the task: On a schedule.
- Settings: Daily.
- Check Repeat task every: > select or type 15 minutes (or your preferred polling frequency).
- Duration of: Indefinitely.
- Ensure Enabled is checked.
Finally, under the Actions Tab, click New and configure the following.
- Action: Start a program
- Program/script: “C:\Program Files\PowerShell\7\pwsh.exe”
- Add arguments (optional): -ExecutionPolicy Bypass -File “C:\EasyEntra\Scripts\Run-EasyEntraOffboarding.ps1”
- Start in (optional): C:\EasyEntra\Scripts
Click OK to save. Enter the password for svc.EEAutomation when prompted.
Step 6: Trigger an Employee Offboarding
When you want to offboard someone, follow this exact physical folder path workflow.
- Open your File Explorer and navigate to your active trigger directory:
C:\EasyEntra\Offboarding\Input\ - Drop the UPN of the user you want to offboard in .txt file directly into this folder.
3. What happens next:
- When Task Scheduler wakes up (or when you trigger it manually), the script instantly locks onto that .txt file, opens it, and extracts the username string.
- After processing the offboarding commands via EasyEntra, the script will cleanly delete the file from the Input folder and move a copy of it into C:\EasyEntra\Offboarding\Done\ (or \Error\ if it fails).
- If the Invoke-EEDecommissionHybridUser command encounters an issue, such as a typo in the username, a network timeout, or expired service account credentials, the offboarding job is marked as failed. The .txt file is physically moved out of C:\EasyEntra\Offboarding\Input\ and dropped directly into: C:\EasyEntra\Offboarding\Error\
4. You can check the Logs folder to track everything the script does, whether it succeeds or fails. The last few lines will tell you the exact error message (like a missing connection or a user not found) so you know exactly how to fix it.
That’s it! By combining EasyEntra, a dedicated service account, PowerShell automation, and Windows Task Scheduler, you can transform employee offboarding from a lengthy manual process into a reliable, unattended workflow.
This approach not only reduces administrative effort but also minimizes the risk of missed steps, improves security by enforcing least-privilege access, and provides a scalable solution for organizations managing hybrid Active Directory and Microsoft Entra environments!
