Microsoft 365 User Offboarding Checklist#
This guide outlines a complete process for properly offboarding a user in a hybrid Microsoft 365 environment (with on-premises Active Directory synced via Microsoft Entra Connect).
Step 1. Disable the User#
Disable the user in on-premises Active Directory (AD) and confirm the change syncs to Microsoft Entra ID, ensuring the account is also locked in the cloud.
Tip: Some organizations move disabled users to a non-synced OU, which is incorrect. You must keep the disabled user in a synced OU so that their cloud account also becomes blocked.
Step 2. Reset the User’s Password#
Reset the password in on-premises AD. This new password will automatically sync to Microsoft 365 through Microsoft Entra Connect.
Step 3. Reassign Email Aliases#
Transfer any email alias addresses to another mailbox if they need to be reused. If they’re no longer required, you can either retain or remove them as needed.
Step 4. Remove the User from All Groups#
In Active Directory, remove the user from all on-premises security and distribution groups.
Also verify that the user is removed from any Microsoft 365 groups in the cloud.
Step 5. Sign Out of All Sessions#
Force the user to sign out of all sessions across both on-premises and Microsoft 365 environments.
You can use PowerShell to sign users out of Microsoft 365 sessions:
See: Force sign-out users in Microsoft 365 with PowerShell.
Step 6. Convert the Mailbox to a Shared Mailbox#
If you’re using an Exchange Hybrid setup, convert the mailbox using the Exchange Management Shell (on-premises).
After the next sync cycle, the change will replicate to Microsoft 365.
Once confirmed, you can safely remove the license.
Note: If the mailbox size exceeds 50 GB, you may still convert it, but you’ll need to retain a license.
Consider assigning an Exchange Online Plan 2 license to maintain mailbox access for larger shared mailboxes—it’s affordable and ensures continuity.
Step 7. Remove Delegated Access#
Remove any mailbox delegations unless specific users still require access. This prevents unauthorized deletion or modification of mailbox data.
Step 8. Hide the Mailbox from the Global Address List (GAL)#
Hide the user’s mailbox from the Global Address List to prevent others from attempting to email them once they’ve left the organization.
Step 9. Configure Email Forwarding (Optional)#
If forwarding is needed (e.g., to a new external address):
- Enable external forwarding in Microsoft 365 for the appropriate admin-controlled group.
- Set up forwarding in the Microsoft 365 Admin Center for easy visibility and management.
- Test by sending a message and verifying it forwards correctly.
Security Note: External forwarding is disabled by default for protection—only enable it when necessary.
Step 10. Export the Mailbox to a PST#
If you plan to discontinue forwarding and remove the license later, export the mailbox to a PST file for archival.
Store the file securely for future reference or legal needs.
Step 11. Remove the License#
Once the mailbox has been converted to shared (and is under 50 GB), or if the user account is no longer needed, remove the license to free up your Microsoft 365 subscription.
Step 12. Delete the User Account#
Finally, delete the user from on-premises Active Directory.
Microsoft Entra Connect will sync this change, removing the corresponding cloud account automatically.
To restore a deleted user, see Restore deleted Microsoft 365 Hybrid user.
✅ Conclusion#
You’ve completed the offboarding process for a hybrid Microsoft 365 user.
Although these steps may vary by organization, maintaining an up-to-date checklist helps ensure consistency and compliance. Once your checklist is stable, consider automating it with PowerShell to save time.
Related Reading:
