Home · Lessons

Cloud identity

How to offboard a user in Microsoft Entra ID

When someone leaves, their cloud sign-in has to end, and so do the sessions they already have open. Their registered devices need the same treatment. This lesson walks through the steps, with Microsoft Graph PowerShell commands for each one.

1. Confirm the request and find the user

As with on-premises accounts, start with the request from HR or the manager. Confirm the name and the effective date. Then find the user by their user principal name (UPN), which is the sign-in name. Use the search form, and add the consistency flag, which the search needs:

Get-MgUser -Search "UserPrincipalName:[email protected]" -ConsistencyLevel eventual

Note the user's object ID from the output. The next commands use it.

2. Block sign-in

Turn off the account so new sign-ins are refused. This does not end sessions that are already open, which is why the next step matters.

Update-MgUser -UserId <object-id> -AccountEnabled:$false

3. Revoke open sessions

Revoke the user's sign-in sessions, so tokens already issued stop working. Do this after blocking sign-in, so the user can't sign in again straight away.

Revoke-MgUserSignInSession -UserId <object-id>

4. Disable their devices

Devices the user registered, such as a laptop or phone, can still reach company data unless they're disabled. List the devices, then pipe them into the device update:

Get-MgUserRegisteredDevice -UserId <object-id> | Update-MgDevice -AccountEnabled:$false

Check the device list first. A device may be shared with other people, or may be a company device that someone else needs. Confirm before you disable it.

5. Licences and group access

Remove the user's Microsoft 365 licences and their cloud group memberships as your organisation's process requires. This lesson doesn't give exact commands for those steps, so use the Microsoft 365 admin centre or Entra admin centre, and follow your team's checklist. Decisions about mailboxes, files, and shared access belong to the manager, so ask before you change them.

6. Record the change

Write in the ticket who asked, when each step was done, and which devices were disabled. A clear record makes it easier to answer later questions about the account.

Permissions

Updating user accounts needs a directory role such as User Administrator. Updating devices needs a device role such as Cloud Device Administrator. Global Administrator covers both. Check your own role before you run these commands.