Offboarding in Entra ID: make sure former employees do not keep access

Think of Outlook on a phone that is still signed in. Revoking sessions is an important extra step in shutting off access.

Revoke sessions invalidates all of the user's refresh tokens, and the session cookies in their browser as well. Technically it sets the property signInSessionsValidFromDateTime to now: anything issued before that no longer counts. Every app that wants a new token has to make the user sign in again, and with a disabled account that fails.

• In the admin center: Entra ID, Users, choose the user and click Revoke sessions on the overview page.
• In PowerShell: Revoke-MgUserSignInSession -UserId <id or UPN> from the Microsoft.Graph.Users.Actions module.
• Through Microsoft Graph: POST /users/{id}/revokeSignInSessions, with the permission User.RevokeSessions.All.

Microsoft notes that revoking can take a few minutes. There are two things it does not do: access tokens already issued stay valid until they expire, except in apps that support Continuous Access Evaluation (see below). And it does not work for guest users, because they sign in at their own organisation.

Some Microsoft services respond faster to a blocked account than other applications. That difference matters if you want to know for certain when access ends.

With Continuous Access Evaluation (CAE), Entra ID talks directly to the service that receives the token. For a number of critical events, Entra ID tells the service that this user's tokens no longer apply, even if they have not expired yet. The client then gets a claim challenge and has to sign in again. Microsoft lists these events:

• the account has been deleted or disabled;
• the password has been changed or reset;
• MFA has been enabled for the user;
• an administrator has revoked all refresh tokens (revoke sessions);
• Entra ID Protection detects a high user risk.

This works for Exchange Online, SharePoint Online and Teams, with clients that support it, such as the current versions of Outlook, Teams and OneDrive. It is independent of Conditional Access and so works in every tenant. Microsoft aims for near-instant, but mentions a delay of up to 15 minutes.

An account is more than a username and password. Think about shared mailboxes, devices and access in other systems as well.

Once the tokens are gone, direct access is closed. But there is more to an account than signing in. This stays in place until someone cleans it up:

A fixed order keeps access from staying open and important data from disappearing too early.

The order matters: first close the door, then get rid of the tokens, then clean up. If you work hybrid, with accounts from Active Directory, start in AD. You disable a synchronised account in AD; the status reaches Entra ID at the next sync, and with the steps in Entra ID you do not have to wait for that. For an ordinary departure you do everything on the last working day; for a departure after a dispute or with a suspicion of misuse you do steps 1 to 4 straight away.

1. 1Hybrid: in Active Directory. Disable the account with Disable-ADAccount and reset the password. Microsoft recommends resetting it twice, against pass-the-hash; if you can assume the account has not been taken over, once is enough.
2. 2Block sign-in in Entra ID (AccountEnabled set to false).
3. 3Revoke sessions with Revoke-MgUserSignInSession.
4. 4Disable devices registered to the user, and where needed wipe them through Intune. If it is a personal phone, only wipe the company data from the managed apps.
5. 5Remove MFA methods, so that an account reopened later has to register again.
6. 6The mailbox: remove forwarding and inbox rules that forward, set an automatic reply with the new contact, and convert the mailbox to a shared mailbox or give the successor permissions. How that works is in shared mailbox permissions.
7. 7Transfer ownership of groups, Teams and app registrations the leaver owned, and remove the account from groups and application assignments.
8. 8Revoke consent for apps that the user granted themselves.
9. 9Free up licences. Mail, contacts and calendar are then kept for 30 days. See removing licences when employees leave.
10. 10Delete after the retention period. A deleted account stays among the deleted users for 30 days and can be restored during that time. You delete a synchronised account in AD.

# Hybrid: Active Directory first
Disable-ADAccount -Identity "jan.jansen"
Set-ADAccountPassword -Identity "jan.jansen" -Reset -NewPassword (Read-Host -AsSecureString "Nieuw wachtwoord 1")
Set-ADAccountPassword -Identity "jan.jansen" -Reset -NewPassword (Read-Host -AsSecureString "Nieuw wachtwoord 2")

# Entra ID
Connect-MgGraph -Scopes "User.ReadWrite.All","Directory.AccessAsUser.All"
$user = Get-MgUser -UserId "jan.jansen@bedrijf.nl"

Update-MgUser -UserId $user.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $user.Id

Get-MgUserRegisteredDevice -UserId $user.Id -All | ForEach-Object {
  Update-MgDevice -DeviceId $_.Id -AccountEnabled:$false
}

Connect-MgGraph -Scopes "UserAuthenticationMethod.ReadWrite.All"

Get-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $user.Id | ForEach-Object {
  Remove-MgUserAuthenticationMicrosoftAuthenticatorMethod -UserId $user.Id -MicrosoftAuthenticatorAuthenticationMethodId $_.Id
}
Get-MgUserAuthenticationFido2Method -UserId $user.Id | ForEach-Object {
  Remove-MgUserAuthenticationFido2Method -UserId $user.Id -Fido2AuthenticationMethodId $_.Id
}
Get-MgUserAuthenticationSoftwareOathMethod -UserId $user.Id | ForEach-Object {
  Remove-MgUserAuthenticationSoftwareOathMethod -UserId $user.Id -SoftwareOathAuthenticationMethodId $_.Id
}
Get-MgUserAuthenticationPhoneMethod -UserId $user.Id | ForEach-Object {
  Remove-MgUserAuthenticationPhoneMethod -UserId $user.Id -PhoneAuthenticationMethodId $_.Id
}

Connect-ExchangeOnline
$mb = "jan.jansen@bedrijf.nl"

Set-Mailbox -Identity $mb -ForwardingSmtpAddress $null -ForwardingAddress $null -DeliverToMailboxAndForward $false

Get-InboxRule -Mailbox $mb -IncludeHidden |
  Where-Object { $_.ForwardTo -or $_.ForwardAsAttachmentTo -or $_.RedirectTo } |
  ForEach-Object { Remove-InboxRule -Mailbox $mb -Identity $_.Identity -Confirm:$false }

Set-MailboxAutoReplyConfiguration -Identity $mb -AutoReplyState Enabled `
  -InternalMessage "Jan werkt hier niet meer. Neem contact op met Petra de Vries." `
  -ExternalMessage "Jan werkt hier niet meer. Neem contact op met Petra de Vries."

Set-Mailbox -Identity $mb -Type Shared

# Groups and Teams the leaver owns
Get-MgUserOwnedObject -UserId $user.Id -All |
  Where-Object { $_.AdditionalProperties["@odata.type"] -eq "#microsoft.graph.group" } |
  ForEach-Object { $_.AdditionalProperties["displayName"] }

# Add a new owner
$opvolger = Get-MgUser -UserId "petra.devries@bedrijf.nl"
New-MgGroupOwnerByRef -GroupId "<groep-id>" -BodyParameter @{
  "@odata.id" = "https://graph.microsoft.com/v1.0/users/$($opvolger.Id)"
}

# Consent the user granted to apps themselves
Get-MgUserOauth2PermissionGrant -UserId $user.Id -All | ForEach-Object {
  Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $_.Id
}

If IT only hears afterwards that someone has left, the security backlog has started before the first action is taken.

The commands are not the hard part. The hard part is that they have to run on the right day, for everyone who leaves, even if HR passes it on a day late or the administrator who always does it is on holiday. You do not notice a missed step: a forwarding rule that keeps running gives no error message.

Microsoft has Lifecycle Workflows in Microsoft Entra ID Governance for this. A leaver workflow starts on the leave date (employeeLeaveDateTime) and has tasks such as disabling the account, removing it from groups and Teams, removing licences, revoking all refresh tokens and deleting the user after a number of days. That requires a Governance licence, and a leave date that is reliably in Entra ID. Who fills it in, and whether it is correct, is the question that remains. Mailbox rules and accounts outside Microsoft remain a separate step alongside it.