👥 Recipe · User & Group Management

Offboard a User: Disable Account and Remove M365 Licenses

Block sign-in and reclaim licenses for a departing employee using Microsoft Graph

Complexity

Beginner

Impact

security + cost-savings + offboarding + compliance

Context

Why This Matters

When an employee leaves the organization or changes roles, two of the most time-sensitive offboarding actions are blocking sign-in and reclaiming their assigned licenses. Disabling the account immediately revokes interactive access to Microsoft 365 services, while removing the license frees up a paid seat that can be reassigned to another user — directly reducing wasted spend.

This recipe covers the minimal, safe offboarding path: locate the user, audit their current licenses, disable the account, and remove all assigned SKUs. The user object itself is retained so that mailbox content, OneDrive files, and audit history remain accessible for any later retrieval or legal hold.

Run this as soon as HR confirms a termination or last working day. For a full offboarding workflow (mailbox conversion to shared, OneDrive handoff, group cleanup, MFA method revocation), chain this recipe with related offboarding recipes.

Expected Outcomes

The target user's accountEnabled flag is set to false, blocking all interactive and token-based sign-ins.
All Microsoft 365 SKUs assigned directly to the user are removed, returning seats to the available pool.
The user object, mailbox, and OneDrive remain intact for data retention and retrieval.
An auditable record of the disable + license removal actions is written to the Entra audit log.

Risks & Considerations

Before you run this

Do not delete the user. Deletion purges mailbox and OneDrive after 30 days. Disable + license removal is reversible and preserves data.
Group-based licenses. If the user's license was assigned via a group (not directly), removing it with assignLicense will fail. Remove the user from the licensing group instead.
Shared mailbox conversion. Removing an Exchange license deletes the mailbox after 30 days. If you need to retain email access for a manager, convert to a shared mailbox before removing the license, or place the mailbox on Litigation Hold.
Active sessions. Disabling the account does not immediately kill existing OAuth tokens. Run revokeSignInSessions as a follow-up to force re-authentication within ~1 hour.
OneDrive retention. OneDrive content is retained for 30 days by default after license removal unless you transfer ownership or extend retention via the SharePoint admin center.

Required Permissions

Permission	Why It's Needed
User.ReadWrite.All	Required to PATCH the user object and set accountEnabled=false.
Directory.ReadWrite.All	Required to call assignLicense and remove SKUs from the user.
Organization.Read.All	Useful to resolve skuPartNumber to skuId when scripting against multiple tenants.
User.Read.All	Required to resolve the user by UPN or display name before making changes.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Offboard {user}: disable their account to block sign-in and remove all assigned Microsoft 365 licenses. Leave the user object intact so mailbox and OneDrive data are retained, and revoke any active sessions.

Try in Dex Pro

Disable a user and remove licenses via the Microsoft 365 admin center

Sign in to the Microsoft 365 admin center as a User Administrator or Global Administrator.
Navigate to Users → Active users.
Search for the departing employee by name or UPN (for example adrian@contoso.com) and click the row to open the user pane.
On the Account tab, click Block sign-in. In the dialog, check Block this user from signing in and click Save changes. This sets accountEnabled to false.
(Recommended) Still on the Account tab, click Sign out of all sessions to revoke active refresh tokens.
Switch to the Licenses and apps tab.
Uncheck every assigned license (for example Microsoft 365 Business Premium). If a license is greyed out, it is inherited from a group — remove the user from that group under Groups → Active groups instead.
Click Save changes.
Verify: reopen the user, confirm the banner reads Sign-in blocked and the Licenses tab shows No licenses assigned.

Optional follow-ups

Convert the mailbox to Shared under Exchange admin center → Recipients → Mailboxes before the 30-day license grace period expires.
Transfer OneDrive ownership to the user's manager under SharePoint admin center → More features → User profiles.

Offboard a user with Microsoft Graph

This is a three-call sequence: resolve the user, disable the account, and remove all license SKUs. All endpoints are on https://graph.microsoft.com.

1. Resolve the user

GET /v1.0/users?$filter=userPrincipalName eq '{user_upn}'&$select=id,displayName,userPrincipalName,accountEnabled

Example response:

{
  "value": [{
    "id": "6ec10ce2-e41b-46cb-bda2-2900a8965720",
    "displayName": "Adrian Blackmon",
    "userPrincipalName": "adrian@contoso.com",
    "accountEnabled": true
  }]
}

2. Audit current licenses

GET /v1.0/users/{user_id}/licenseDetails?$select=skuId,skuPartNumber

Capture the skuId values — you will pass them into the remove call in step 4.

3. Disable the account

PATCH /v1.0/users/{user_id}
Content-Type: application/json

{ "accountEnabled": false }

Expected response: 204 No Content.

4. Remove all licenses

POST /v1.0/users/{user_id}/assignLicense
Content-Type: application/json

{
  "addLicenses": [],
  "removeLicenses": ["f245ecc8-75af-4f8e-b61f-27d8114de5f3"]
}

Expected response: 200 OK with the updated user object.

5. (Recommended) Revoke active sessions

POST /v1.0/users/{user_id}/revokeSignInSessions

Returns { "value": true }. All issued refresh tokens are invalidated within ~1 hour.

Common errors

Code	Cause	Fix
`400 BadRequest` on assignLicense	License is inherited from a group	Remove user from the licensing group instead
`403 Forbidden`	Missing Directory.ReadWrite.All	Grant admin consent in Entra
`404 NotFound`	User already deleted	Check the Deleted users view

Offboard a user with PowerShell and Microsoft Graph

Use the Microsoft Graph PowerShell SDK (Microsoft.Graph). Install once with Install-Module Microsoft.Graph -Scope CurrentUser.

Connect with the right scopes

Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All", "Organization.Read.All"

Resolve and inspect the user

$upn = "adrian@contoso.com"
$user = Get-MgUser -UserId $upn -Property Id,DisplayName,AccountEnabled,AssignedLicenses
$user | Format-List

Disable the account

Update-MgUser -UserId $user.Id -AccountEnabled:$false

Remove all licenses

$skuIds = $user.AssignedLicenses.SkuId
Set-MgUserLicense -UserId $user.Id -AddLicenses @() -RemoveLicenses $skuIds

Revoke sessions

Revoke-MgUserSignInSession -UserId $user.Id

The downloadable script below wraps all of this with parameter validation, a -WhatIf switch, and a transcript log suitable for audit evidence.

Next steps

More User & Group Management recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.