When an employee leaves an organization, IT administrators must carry out a series of security and compliance actions to properly decommission the user account. Missing even a single step can leave sensitive data exposed, allow continued access to corporate systems, or result in unnecessary license costs.
User offboarding becomes especially challenging in hybrid environments, where organizations operate both on-premises Active Directory and cloud services such as MS Entra ID and Exchange Online. In these environments:
- Account actions typically occur in on-premises Active Directory.
- Changes are synchronized to MS Entra ID via MS Entra Connect.
- Mailbox actions are performed in Exchange Online.
This means administrators often need to coordinate actions across multiple systems, sometimes waiting 15-30 minutes for directory sync between steps. To ensure consistency and security, IT teams benefit from a structured offboarding checklist.
Below are 18 key user decommissioning tasks commonly required when offboarding an employee.
18 Essential User Decommissioning Tasks in Microsoft 365 Environment
User offboarding typically involves a combination of identity, security, and mailbox management actions.
Account and Security Actions
These actions ensure the user can no longer access corporate resources.
- Disable the account – Disabling the account immediately blocks sign-in to Microsoft 365 and connected services.
- Revoke active sessions – Existing login sessions and authentication tokens are revoked to force immediate sign-out across all devices and applications.
- Reset the password – Resetting the password prevents the user from accessing services through cached credentials.
- Move the account – The account can be moved to a dedicated Disabled Users OU or similar organizational unit for easier management.
- Update the display name – Many organizations modify the display name (for example, Former Employee) to clearly indicate the account status.
- Set a description – Administrators may update the description field to include offboarding notes such as termination date or ticket reference.
- Remove group memberships – The user should be removed from both On-premises Active Directory groups and Cloud-based Microsoft 365 groups, ensuring no memberships remain in either Entra ID or Exchange Online.
- Remove Microsoft 365 license – Assigned licenses should be removed so they can be reallocated to other users.
- Remove the profile picture – Removing the profile image helps avoid confusion in directories or collaboration tools.
Mailbox Management ActionsEmail continuity and mailbox security must be handled during the offboarding process.
- Hide the mailbox from address lists – This prevents users from accidentally sending new email messages to the former employee.
- Convert the mailbox to a shared mailbox – Converting the mailbox allows authorized staff to access historical emails without consuming a license.
- Configure a delegate – A delegate (often the employee’s manager) may be assigned to handle incoming communications.
- Grant mailbox access to the delegate – Delegates can be granted appropriate permissions to manage the mailbox.
- Forward emails to a delegate – Incoming messages can automatically be forwarded to ensure important communications are not missed.
- Enable automatic replies – Automatic replies notify senders that the employee is no longer with the organization and may provide an alternative contact.
- Remove existing mailbox permissions – Any permissions previously granted to other users should be reviewed and removed where necessary.
- Remove calendar events organized by the user – Meetings organized by the departing employee may need to be removed or reassigned to avoid confusion. Recurring meetings can otherwise remain stuck in meeting rooms and coworkers’ calendars after the account is removed.
- Remove inbox rules – Inbox rules created by the user may redirect or automatically delete messages, so these should be removed.
Why Offboarding Is Difficult with Standard Microsoft 365 Tools
Using Microsoft’s native administration tools, these actions must be completed across multiple locations:
- Active Directory
- Exchange on-premises
- Microsoft 365 admin center
- Microsoft Entra ID portal/Entra Connect
- Exchange admin center
- PowerShell
Each portal contains only part of the required functionality. As a result, administrators often need to switch between multiple admin interfaces, manually track completed actions, and follow internal checklists.
There is no single offboarding wizard that ensures all steps are executed in a consistent way. This fragmented process increases the risk that an important step could be missed.
Microsoft 365 User Offboarding Automation via PowerShell
Rather than navigating multiple admin portals, the script below consolidates the entire offboarding process into a single PowerShell execution. It logs into Microsoft 365, locks the account, resets the password, and kills all active sessions. It then removes the user from all groups, strips their licenses, and configures their mailbox, converting it to shared, hiding it from the address book, setting an auto-reply, and enabling litigation hold.
$UserUPN = "john.doe@contoso.com"
foreach ($mod in @("Microsoft.Graph", "ExchangeOnlineManagement")) {
if (!(Get-Module -ListAvailable -Name $mod)) {
Write-Host "Installing $mod..."
Install-Module $mod -Scope CurrentUser -Force -AllowClobber
}
}
Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.Groups
Import-Module Microsoft.Graph.Identity.SignIns
Import-Module ExchangeOnlineManagement
Write-Host "Connecting to Microsoft Graph..."
Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.ReadWrite.All","Group.ReadWrite.All" -NoWelcome
Write-Host "Connecting to Exchange Online..."
Connect-ExchangeOnline -ShowBanner:$false
try {
$user = Get-MgUser -UserId $UserUPN -ErrorAction Stop
} catch {
Write-Host "ERROR: User '$UserUPN' not found. Exiting." -ForegroundColor Red
exit 1
}
Write-Host "Offboarding user: $($user.DisplayName) [$UserUPN]" -ForegroundColor Cyan
# Disable account
Write-Host " [1/7] Disabling account..."
Update-MgUser -UserId $user.Id -AccountEnabled:$false
# Reset password (your preferred method)
Write-Host " [2/7] Resetting password..."
$password = -join ((65..90)+(97..122)+(48..57) | Get-Random -Count 14 | % {[char]$_})
$params = @{
passwordProfile = @{
forceChangePasswordNextSignIn = $true
password = $password
}
}
Update-MgUser -UserId $user.Id -BodyParameter $params
Write-Host "Temporary password: $password" -ForegroundColor Yellow
# Revoke sessions
Write-Host " [3/7] Revoking sign-in sessions..."
Revoke-MgUserSignInSession -UserId $user.Id | Out-Null
# Remove group memberships
Write-Host " [4/7] Removing group memberships..."
$memberships = Get-MgUserMemberOf -UserId $user.Id -All
foreach ($obj in $memberships) {
if ($obj.AdditionalProperties.'@odata.type' -eq "#microsoft.graph.group") {
try {
Remove-MgGroupMemberByRef `
-GroupId $obj.Id `
-DirectoryObjectId $user.Id `
-ErrorAction Stop
Write-Host " Removed from group: $($obj.Id)"
} catch {
Write-Host " Could not remove from group $($obj.Id)" -ForegroundColor Yellow
}
}
}
# Wait for mailbox
Write-Host " [5/7] Waiting for mailbox availability..."
$mailboxReady = $false
for ($i = 1; $i -le 6; $i++) {
try {
$mbx = Get-Mailbox -Identity $UserUPN -ErrorAction Stop
$mailboxReady = $true
break
}
catch {
Write-Host " Attempt $i/6 — mailbox not ready yet, waiting 10s..."
Start-Sleep -Seconds 10
}
}
# Mailbox actions BEFORE license removal
if ($mailboxReady) {
Write-Host " [6/7] Configuring mailbox..."
# Convert to shared mailbox first
Set-Mailbox -Identity $UserUPN -Type Shared -ErrorAction SilentlyContinue
Set-Mailbox -Identity $UserUPN -HiddenFromAddressListsEnabled $true
Set-MailboxAutoReplyConfiguration -Identity $UserUPN `
-AutoReplyState Enabled `
-InternalMessage "This employee is no longer with the organization." `
-ExternalMessage "This employee is no longer with the organization."
Set-Mailbox -Identity $UserUPN -LitigationHoldEnabled $true
}
else {
Write-Host " WARN: Mailbox not reachable after retries — skipping mailbox steps." -ForegroundColor Yellow
Write-Host " Re-run just the mailbox block manually once replication completes."
}
# Remove licenses AFTER mailbox conversion
Write-Host " [7/7] Removing licenses..."
try {
$licenseDetails = Get-MgUserLicenseDetail -UserId $user.Id
if ($licenseDetails) {
$skuIds = $licenseDetails | Select-Object -ExpandProperty SkuId
Set-MgUserLicense `
-UserId $user.Id `
-AddLicenses @() `
-RemoveLicenses $skuIds
Write-Host " Attempted to remove $($skuIds.Count) license(s)."
}
else {
Write-Host " No licenses found."
}
}
catch {
Write-Host " License removal failed (possibly group-assigned license)." -ForegroundColor Yellow
}
Write-Host ""
Write-Host "Offboarding completed for $UserUPN" -ForegroundColor GreenWhile scripting can reduce manual effort, administrators must still maintain scripts and verify that each step executes correctly.
Simplify Offboarding With Easy Entra
EasyEntra simplifies the entire offboarding process. Instead of navigating multiple admin portals or maintaining complex scripts, administrators can simply:
Right-click the user and select “Decommission.”
A two-step wizard then displays all 18 account and mailbox decommissioning actions in one place.
Administrators can select the required actions and perform the offboarding process. The selected options can be saved as default settings, ensuring future offboarding processes remain consistent across the organization.
For hybrid environments, EasyEntra automatically coordinates the required steps across:
- Active Directory
- Entra ID
- Exchange Online
Actions are executed in the correct order, eliminating manual coordination and directory synchronization delays.
EasyEntra also provides a scripting API that enables administrators to automate and schedule the decommissioning process.
Offboarding is executed from a single CmdLet with a single parameter (the user ID) and processes the same settings selected in the UI.
The scripted approach is particularly useful for scheduling or batch processing of user offboarding.
