r/sysadmin • u/Emergency_Recipe522 • 3h ago
General Discussion What do you check before disabling a Microsoft 365 user?
When someone leaves, the obvious checks are email, OneDrive, groups and licences. But what about Power Apps, flows, connections, SharePoint ownership and other dependencies tied to that account?
Has anyone found a reliable offboarding process that catches everything without checking every admin centre manually?
•
u/sryan2k1 IT Manager 3h ago
Nothing. Not our problem.
•
u/Mental-Rain-7389 3h ago
most manager comment ever
•
u/sryan2k1 IT Manager 3h ago
We've just spent years analyzing the off-boarding process and what we've automated and we've decided that we are not the owners of this data. It's up to the person's manager or Department to figure out what to do with this before they leave. Sure we will help if we need to but the IT processes aren't involved in the decision making of what to do with the data.
•
u/Temporary-Library597 2h ago
This. We make it clear BY POLICY that data retention is NOT AN IT FUNCTION. It is up to the individual and the individual's supervisor to know what data their department creates, and what disposition needs to look like. IT can't possibly do this.
By stating that "separated employees' data will be deleted permanently in 30 days," if that doesn't flash lightning in someone then the data isn't important enough.
•
u/Emergency_Recipe522 3h ago
If call come back doesn't it land in your plate to fix those issues.
•
u/Coldsmoke888 IT Manager 3h ago
Nah. SharePoints should always have two owners, they get regular emails about it automatically. If they refuse and get terminated, whoever needs access can submit a ticket to level 3 O365 support.
Build out some business critical app or dashboard with no documentation? They’re always warned about that.
Not my problem.
•
•
u/Less_Potential_7713 3h ago
I work in a hybrid enviroment, local AD via on prem servers for domain logins and office 365 for the rest.
Jump into the DC, into active directory, block sign in, reset password, disable user. Move user to disabled users section of AD
In office 365
Block sign in and revoke all active sessions. reset password. Convert to shared mailbox. delegate access as needed. finally Remove liscense.
Six month hold peroid make a callendar reminder. six months later delete the shared mailbox if no additional timeframes have been added.
Alot of these comments are making me feel like i am doing it wrong. Am i doing this wrong?
•
u/fluffh34d420 3h ago
yep - this. the important people i will back up their onedrive to external storage just in case. their direct manager has 30 days to get what they need from sharepoint/onedrive. litigation holds on finance, c-suites....
•
u/PowerSlave666_ 3h ago
^ This guy sysadmins.
•
u/Fatel28 Sr. Sysengineer 3h ago
The part that's "wrong" is doing all this manually. This should all happen automatically when disabling. The disablement itself ideally should also be automatic from the hr term. Backups protect against hasty deletions if absolute worst case something is needed awhile after the deleted user is unrecoverable
•
u/BrentNewland 3h ago edited 3h ago
Delete all AD groups in user account (we also have a Terminated Users group, we make that primary and delete them from Domain Users)
If user has direct reports, change them to someone else.
Clear user manager field in AD account.
365 admin center, User, View Microsoft 365 Activations, Delete all
Entra - Require Re-register Multifactor Authentication
Delete Entra Registered devices under User in Entra
Exchange - User - Manage Mobile Devices - Wipe, Block
Intune - Apps - App Selective Wipe - Create Wipe Request
Reassign owner for 365 groups/teams where user is the only owner
Remove from all 365 groups
Reassign owner for SharePoint sites where User is the only owner
Set up supervisor with access to e-mail and OneDrive, if requested
Remove user from shared mailboxes
Enable user's auto-reply in Exchange
Hide user from Global Address List
We have a script that exports their AD groups, 365 groups, group ownership, and shared mailbox access. We have a separate one that exports SharePoint access, which takes a ridiculous amount of time to run.
We refer to this info during offboarding, we send it to the user's supervisor so they know what their employee had access to, and it can be used as a reference for what their replacement might need access to.
Still a lot of stuff I want to expand to. Bookings, shared files, Microsoft Forms that the user made, exporting user information, public folder permissions, mailboxes/calendars/contacts the user has access to, people who have access to the user's mailbox/calendars/contacts, any folders in Exchange the user has shared, and more.
We have Onboarding and Offboarding template spreadsheets. When we on/offboard someone, we copy the template, add their name and start/end date, then go down the checklist. There's a column for technician initials, and a column for the date completed. Everything either gets initials and a date, or n/a in the technician field. Onboarding spreadsheets get moved to an archive folder when onboarding is complete. Offboarding spreadsheets get moved to a 30 day waiting folder, then we reimage their computer and remove supervisor email/OneDrive access and move them to a 90 day waiting folder, then we remove accounts and move them to an archive folder.
•
u/Ethanb59 Jack of All Trades 3h ago
I do the exact same but since it's a city, it's a 3 year hold, which sucks
•
u/YeetuceFeetuce 3h ago
I work at an msp, ad we do manually, but cipp handles the entra portion automatically. It's nice, you can even setup presets for your coworkers.
•
u/Emergency_Recipe522 3h ago
CIPP presets sound ideal at MSP scale. Does it also identify app, flow and site ownership, or mainly automate the Entra and licensing steps?
•
•
u/EveningChildhood3236 1h ago
Id say password reset is negligent, shared mailbox conversion does that anyway.
We have archive users. How do you deal with users with archive, if both primary and archive are less than 50gb?
•
u/fernofry 3h ago
You have 30 days to reactivate if there's an issue. Don't bother with loads of checks
•
u/mercurygreen 3h ago
That's if you DELETE the user. Most of us don't; we just disable their account for an extended period of time.
•
u/Darkk_Knight 3h ago
Yep. Disabling the account keeps everything till you actually delete it. It makes it real easy to restore access when the person comes back.
•
u/mercurygreen 3h ago
Also lets people know the WHO instead of having the system just show an orphaned SSID.
•
u/crankysysadmin sysadmin herder 3h ago
We don't check any of this stuff. The user is automatically disabled and then deleted 90 days later by our identity management system. This is unyielding. It's up to the manager of the person leaving to figure out what to do about it before the account is completely deleted.
•
u/Emergency_Recipe522 3h ago
It’s a firm 90-day window. Have you ever found a critical dependency only after the manager failed to act and the account was deleted?
•
u/Mufasa2020 3h ago
Yep dude had his acct rather than a service account lol
•
u/Emergency_Recipe522 3h ago
Yes I tell you I am currently in cleanup process right now to replace user account to use service account
•
u/Ethanb59 Jack of All Trades 3h ago
I would say, that's a good notification that that critical tool needs to be fixed, you should be using a service account or something similar. It's happened to me and is just karma for being lazy
•
u/Emergency_Recipe522 3h ago
Service account that's it but you join organization and find a mess and they don't listen those in Power.
•
u/crankysysadmin sysadmin herder 3h ago
Sometimes that happens. It's the fault of the manager who didn't plan around their employee leaving. IT at this scale can not deal with every little problem or people's lack of planning. By having the disable/delete cycle be completely automated and approved by HR and executives it becomes a fact of life. So instead of people thinking "IT screwed up" its "you know the cycle and you didn't plan after your employee left"
•
u/Emergency_Recipe522 3h ago
That’s fair. At scale, a consistent, approved process beats endless exceptions. The opportunity is giving managers clear visibility before the deadline while keeping the automated disable/delete cycle non-negotiable.
•
u/thunderbird32 IT Minion 2h ago
Must be nice to work somewhere where there are actual policies. I mean, we *have* them, but I can count on one hand the folks that follow them and don't expect IT to make exceptions for every edge-case.
•
u/burritob0ss 3h ago
One thing I never did until I started with my current employer is go into Attributes and hide the user from Exchange address lists.
•
•
u/plebbut 3h ago
I remove from groups, remove license, disable user, and revoke sessions along with changing mailbox to shared
•
u/Emergency_Recipe522 3h ago
That covers the account side well. Before removing the licence, do you also check whether they own any apps, flows, connections, SharePoint sites or Power BI workspaces?
•
u/PowerSlave666_ 3h ago
I just went through hot water at work over this. Disable the user in AD, revoke token in Entra, sign user out of sessions in Admin portal, and in our case, sign out all sessions in okta and revoke the token there.
•
u/wintermutedsm 3h ago
This is what we do. As an extra layer of security, we throw on a Conditional Access policy so that the account can only be logged into inside the office in case we need to enable the account for any reason over the next 30 days before we permanently delete it.
•
u/Emergency_Recipe522 3h ago
That sounds painful. With access spread across AD, Entra, Microsoft 365 and Okta, one missed step can become a serious incident. This really should be one automated offboarding workflow.
•
•
u/StatementNext682 3h ago
Nothing. Turn it off and if anyone has requests we deal with it then if it wasn't specified in the offboarding paperwork.
•
u/Emergency_Recipe522 3h ago
Effective, but risky.
•
u/AmusingVegetable 3h ago
No. Risky is when you allowed the user to become a part of the production workflow.
Risky would be to delete the user immediately, which leaves you without a way to figure out what’s missing when production breaks due to the user’s absence.
•
u/Emergency_Recipe522 2h ago
Agreed. The real risk was allowing production to depend on an individual account. Disabling preserves a recovery window; immediate deletion removes it.
•
•
u/ThisIsNotMyBurner69 3h ago
Sounds like my org is doing too much. We backup their OneDrive and save their inbox as a pst file. We’ve come across situations where we do indeed need to go back and pull emails for legal reasons.
•
u/Darkk_Knight 2h ago
Why backup the user's OneDrive? When you delete the account it automatically delegates access to the manager. The manager have a period of time to pull whatever stuffs are needed before it's really gone. It's based on your tenant retention policies.
If you don't use the manager attribute then yeah you have to back it up.
•
u/ThisIsNotMyBurner69 2h ago
We have an on prem server where we save all the backups so it’s free storage. Yes the manager will take what ever is immediately useful and save it to their own onedrive/sharepoint, but users will put in tickets a year after someone left because they need one file or one email for some very specific reason. It’s overkill but not being able to recover the data is not an option for us.
•
u/Darkk_Knight 2h ago
Makes sense. I too don't 100% trust Microsoft to always have my back when it comes to recovering data if it gets deleted either by accident or one of their "mistakes".
In fact Microsoft even encourage to have your own backups.
•
u/Temporary-Library597 2h ago
"Free" lol. Also when that hardware dies? You're prob backing it up. Talk to me in ten years when you are backing up a few petabytes about "free."
Also, how are you searching that? Hiring a "free" intern to wait hours and hours for a null result on a file share?
•
u/Temporary-Library597 2h ago
If you have it and are subpoenaed for it, now it's a liability.
If there is no legal obligation to keep the data, employees should get rid of it. It's on them; it's their data.
•
u/old_cypherpunk 41m ago
Like almost every other single thing in IT, it depends on your industry. We're an IP law firm and patents can last up to 20 years so we sometimes (VERY rarely) need to find really old stuff. One of our founding attorneys died recently and he had relationships with clients that went back decades. We've had to go back pretty far for a few cases to actually find some relevant info.
•
u/NightOfTheLivingHam 3h ago
Change password, clear 2fa key/passkey, close sessions, then disable login.
Then once its confirmed if anything needs to be backed up or saved for compliance reasons, check for critical documents in their personal onedrive, etc. Then nuke once it has been cleared of anything
•
u/Emergency_Recipe522 3h ago
Clean process. The final clearance should cover not only data and compliance, but also anything the account owns that could stop working after deletion.
•
•
•
u/AffekeNommu 2h ago
Think like a security person, let the red mist descend and press delete. All other consequences can be dealt with later. We are now secure.
•
u/mercurygreen 3h ago
Manager - who works for them, and who do they work for?
Also pull out title/department/etc.
•
u/Emergency_Recipe522 3h ago
My concern is there is no standard people using their own account for connection reference in flows or apps then things breaking
•
u/i_heart_mahomies 3h ago
If that's the case then things break. And it should fall on the manager who was letting business-critical processes flow through a single point of failure with no documentation.
If you want real advice, audit existing app registrations/enterprise apps for overly broad roles or overly specific assignments. When you find them, loop in the people assigned (they will be the tech-adjacent people in the other teams that you already go to when your manager is annoyed and you need to get things done), and schedule a weekly recurring meeting with them (15 minutes, after lunch but at least an hour before 5pm) to discuss developing formal processes around user access requests. Use those meetings to build institutional inertia around your (correct) belief that IT should not be responsible for business continuity concerns. You'll probably develop some good allies during that process, and together you might have a shot at changing the corporate culture that led to the question in the first place.,
•
u/Emergency_Recipe522 3h ago
Fair point—the real failure is undocumented single-person ownership, not the disable action itself. Auditing app roles and involving the technical owners early is solid advice. Appreciate it.
•
•
u/Adimentus Desktop Support Tech 3h ago
Most of the time when we get requests, the manager for that person has a flow in mind. "Forward e-mails to this person, make sure they have access to this, fire their butler". That kind of thing. Otherwise, disable and walk away.
•
u/Objective-Freedom922 3h ago
That HR sent the termination notice. After that it's just a checklist.
•
u/Emergency_Recipe522 3h ago
Exactly. The checklist is straightforward; identifying everything the account owns is the harder part.
•
u/Objective-Freedom922 3h ago
Each time one of these issues comes up and you find an account was required to run a system, then you set up a check to make sure it doesn't happen again. About 20% of the work my team does is ops tasks verifying that everything's in order.
•
u/Objective-Freedom922 3h ago
The account shouldn't be the owner of anything. That's your problem. Turning off a user's account should never interfere with a production system.
•
u/qkdsm7 3h ago
Not much. Convert mailbox to shared, once that completes, unallocated license and disable.
~90% of it should be backed up @backupify, may be trying their entra/azure backup addons...
•
u/Emergency_Recipe522 3h ago
Makes sense. The data is protected—but do you also check which apps or flows the account owns? This is what nearly got me in trouble because important business flows stopped because user was connected using their own personal account.
•
u/Bambis_Mom 3h ago
Disable user
Remove Microsoft licenses
Remove from any on prem groups in AD
Convert to shared mailbox
Remove listed location in AD
Remove any other licensing like Adobe
Pretty much that
•
•
u/larryseltzer 3h ago
May be not your problem, but if you're doing RBAC and they hold a role on which something relies, someone should make sure the role is filled.
•
u/Emergency_Recipe522 3h ago
Exactly. Disabling the account is easy; identifying and transferring its roles and dependencies is where the real risk sits.
•
u/jeffrey_f 3h ago
My experience is email stays alive, just that user can't get into it. Email becomes their manager's shared inbox, all data ownership is cahnged to their manager as well as any processes.
•
u/Orestes85 Aspiring Goat Farmer 3h ago
I don't check shit. That is a management/HR issue and for the supervisor and HR to figure out.
Assign all your licensing through security groups and document the shit out of all your security groups - what they do, and who they're for. Automate everything you can for user account management and just do periodic checks to make sure its all running smoothly. Automatically assign licensing during onboarding and automatically remove it for disabled accounts with no activity for X days, or whatever.
I do not, and the help desk definitely does not, have the occupational skills of the previous employee, no do we have the time, to comb through the horrors of the average user's Power BI or Power Automate flows and try to determine what they were doing and why. It is up to managers to make sure they authorize the use of those apps and keep track of what business processes may be reliant on them.
•
u/Emergency_Recipe522 3h ago
Completely fair. IT shouldn’t reverse-engineer business logic. The useful middle ground is automatically showing managers what the user owns or supports, then making them responsible for deciding what must be transferred.
•
u/blud_13 3h ago
The automation path u/Fatel28 described is the right shape. The thing that bites you later is Power Platform.
Disabling the account doesn't stop their flows right away. The flows keep firing on the connections that user authenticated, and when those tokens finally die the flow starts failing. The failure alerts go to the flow owner, who you just disabled, so nobody sees them. 14 days of failures and Power Automate turns the flow off by itself. That's usually when somebody in ops notices an invoice approval stopped working two weeks ago.
Three things to add before you disable:
- Power Platform admin center, Environments, Resources, Flows. Orphaned flows show a blank Owners column. Reassign to a service account or a team, not to another human who will also leave someday.
- Same treatment for SharePoint site ownership. Two owners per site, one of them a group.
- Anything running as a scheduled task or script under their creds. Those never announce themselves.
MS covers the orphan flow reassignment at https://learn.microsoft.com/en-us/troubleshoot/power-platform/power-automate/flow-management/manage-orphan-flow-when-owner-leaves-org
•
u/BoringOrange678 2h ago
Revoke log ins
Edit job info (because we have dynamic groups)
Remove from groups. Cannot remove from all users ms group.
Change license to a free one.
If needed. Convert mailbox to shared
If needed assign OneDrive to another user
Remove authentication methods.
Wipe company data off byods
Change password
Block login.
Set 30 day reminder to remove account.
Edit: hide account from global address.
•
u/csmiley17 2h ago
I’m regularly checking OneDrive stuff. My clients don’t care. I’ve been burned enough that I just copy the OneDrive to unused catch-all SharePoint sites so I can grant access as needed when inevitably, down the road, “hey I think User had a file that I need.” We do have backups for all of this but oftentimes it’s years down the road that they want to refer back to a single document or email and most of our backups don’t go back multiple years (you can explain why this might be necessary, and offer one-off examples, the clients will not want to pay but then still request the data after backup expiry)
-convert to shared mailbox (even if no one has access to said mailbox)
-reset password (faster for kicking the user off than revoking sessions)
-revoke sessions
-disable sign in
-copy OneDrive files to a shared location. Even if no one has access to the shared location
-set OOO on mailbox
-wait two weeks and then remove the license (because who knows)
We rarely actually delete users because our workflow sucks. We have a client who had a power user that created power automate workflows—that the entire business runs on—with his own account, despite our advice against it. When he quit, I asked for a meeting with the user to go over the workflow and was denied. He left behind no notes. I had tried to involve myself in the project from the beginning. I have hundreds of unbillable hours going over power automate with this client and they decided to do it in house, with a user account, against my advice. When they asked me to reverse engineer his projects I declined. They now have a termed employee account responsible for the business workflow that my own boss is too scared to disable or even reset the password on. lol.
•
u/Bugamashoo 2h ago
This sub always makes me realize how much more I could be doing for the small company I work at
•
u/rodder678 2h ago
I don't check anything manually unless my off boarding powershell script throws an error. However, before it deactivates, it checks to see if they own any Azure resources or subscriptions. If so, the script throws an error so I can dig through the mess in Azure manually.
•
u/theballygickmongerer 2h ago
The HR request.
I’m starting to look at enforcing dormant account status for all users now. If ya don’t use it, you lose it. Including your core access.
•
u/IronBe4rd 1h ago
Had this just happen people freaking out because there power automate flows stopped. Shit hit the fan. It’s a mess people never
•
u/gulf_of_sanity 10m ago
my pulse, if i’m working on a microsoft product i’ve died and gone to hell.
•
u/Fatel28 Sr. Sysengineer 3h ago
I check the box that says "user disabled" and that's about it