Offboarding a leaver in Active Directory and Entra ID: the checklist

When someone leaves an organisation with a hybrid directory, their access lives in two places: the on-premises Active Directory account and its Entra ID counterpart. Disabling the AD account is the step everybody remembers. It is not the step that stops someone reading their mail on a phone this afternoon.

This is the full list, in the order that matters, with the PowerShell for each step. It uses the ActiveDirectory module and Microsoft Graph PowerShell; replace jsmith and jsmith@contoso.com with the leaver's names.

The principle: cut access first, tidy afterwards

Do the steps that stop access before the steps that tidy up. If something interrupts you half way, an account that is shut but untidy is a nuisance; an account that is tidy but still open is a risk.

1. Disable the Active Directory account

Disable-ADAccount -Identity jsmith

This stops new Kerberos and NTLM sign-ins on-premises. If the account is synchronised to Entra ID, the change reaches the cloud at the next sync cycle, every 30 minutes by default. To send it now, run a delta sync on the Entra Connect server:

Start-ADSyncSyncCycle -PolicyType Delta

2. Replace the password with a random one

A disabled account can be re-enabled, by mistake or by someone who should not, and a laptop the leaver still has may hold cached credentials. A long random password nobody knows closes both.

$bytes = [byte[]]::new(24)
[Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
$pw = ConvertTo-SecureString ([Convert]::ToBase64String($bytes)) -AsPlainText -Force
Set-ADAccountPassword -Identity jsmith -Reset -NewPassword $pw

Do not write it down. Nobody needs it.

3. Block sign-in in Entra ID

Do not wait for the sync. Blocking the cloud account takes effect straight away.

Connect-MgGraph -Scopes User.ReadWrite.All, Group.ReadWrite.All
Update-MgUser -UserId jsmith@contoso.com -AccountEnabled:$false

For a synchronised account, Active Directory is the authority. A cloud-side block is undone at the next sync if the AD account is still enabled, which is one more reason step 1 comes first.

4. Revoke their sign-in sessions

This is the step that gets forgotten. Disabling an account stops new sign-ins. It does nothing about the sessions the person already has: the mail app on their phone, Teams on their home computer, a browser still signed in to SharePoint. Those run on tokens that were issued before you disabled anything.

Revoke-MgUserSignInSession -UserId jsmith@contoso.com

This invalidates their refresh tokens and browser session cookies. An access token already issued can still work until it expires, usually within the hour, except in applications that support Continuous Access Evaluation, such as Exchange Online, SharePoint Online and Teams, which act on it within minutes.

5. Record, then remove, their group memberships

Write the memberships down first: when someone asks next month what they had access to, or the leaver turns out to be returning, this is the list you will need.

On-premises:

$groups = (Get-ADUser jsmith -Properties MemberOf).MemberOf
$groups | Out-File "jsmith-groups-$(Get-Date -Format yyyyMMdd).txt"
$groups | ForEach-Object { Remove-ADGroupMember -Identity $_ -Members jsmith -Confirm:$false }

MemberOf leaves out the primary group, usually Domain Users, which Active Directory will not remove an account from anyway.

In Entra ID, remove only the cloud groups. A group synchronised from Active Directory is changed on-premises, and a dynamic group drops the account by its own rule:

$user = Get-MgUser -UserId jsmith@contoso.com
Get-MgUserMemberOf -UserId $user.Id -All |
  Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.group' } |
  ForEach-Object { Get-MgGroup -GroupId $_.Id -Property Id, DisplayName, OnPremisesSyncEnabled, GroupTypes } |
  Where-Object { -not $_.OnPremisesSyncEnabled -and $_.GroupTypes -notcontains 'DynamicMembership' } |
  ForEach-Object { Remove-MgGroupMemberByRef -GroupId $_.Id -DirectoryObjectId $user.Id }

Distribution lists and mail-enabled security groups cannot be changed through Microsoft Graph; remove those in Exchange Online.

6. Move the account to a leavers OU

A leavers organisational unit keeps former staff out of the OUs your Group Policy, scripts and reports are aimed at, and makes them easy to find when the retention period ends.

Get-ADUser jsmith | Move-ADObject -TargetPath "OU=Leavers,DC=contoso,DC=com"

7. Say why in the description

The account should explain itself to someone reading it in Users and Computers a year from now.

Set-ADUser jsmith -Description "Left 2026-10-08. Offboarded by J. Admin, ticket 4821."

8. Hide them from the address lists

If your directory has the Exchange schema, this keeps the leaver out of the global address list, and it synchronises to Exchange Online.

Set-ADUser jsmith -Replace @{ msExchHideFromAddressLists = $true }

What the directory does not cover

The steps above deal with identity. These need deciding separately, and usually by someone other than IT:

• Mail. Often converted to a shared mailbox for a manager, which also frees the licence.
• OneDrive. Give the manager access before the account is deleted; a deleted user's OneDrive is kept for 30 days by default.
• Licences, once mail and files are dealt with.
• Devices. Retire or wipe them in Intune, and collect the hardware.
• Mail forwarding rules set up in their final weeks.
• Anything they knew: shared accounts, service account passwords, Wi-Fi keys, door codes.
• Their reports. Anyone whose manager was the leaver needs a new one.

Doing the directory steps in one action

Hybrid AD Manager has a tool for this, Leavers, and an Offboard… item on the right-click menu of any user, next to Disable Account. It does the eight steps above, on both sides, as one action:

• You read the plan before anything happens: every group by name, every step, and the ones that will be skipped with the reason, such as the primary group, a group held through another group, or a synced or dynamic group in Entra ID. You type the account name to confirm.
• It writes a record of what it changed, what it kept and the previous values, and Restore puts the group memberships and the account's location back. Re-enabling the account stays a separate, deliberate step.
• The cloud half uses your own Microsoft sign-in. The application holds no permissions of its own in your tenant: you connect Entra ID once for the session, so the changes are made with your rights, your Conditional Access applies, and Entra ID's own audit log names you, not an application.
• It lists anyone whose manager was the leaver, and leaves the choice to you.

Leavers takes care of the directory, so mail, files, licences and devices can follow your own process.

Leavers is in the licensed editions, and in the free 30-day trial. More about Hybrid AD Manager · Managing Active Directory from a Mac · Compared with ManageEngine ADManager Plus