Offboard a user
Preview, then run, the steps that end a leaver's access to Microsoft 365, and what needs Exchange.
Updated
On this page
Offboarding ends someone's access in one go, in a safe order. It needs management access.
Run it
- Open the customer → Microsoft 365 → Users and the person who's leaving.
- Manage → Offboard…, choose the steps, then Preview the steps: Revo lists exactly what each step will do (which groups, which licences) before anything changes.
- Type the person's sign-in name to confirm, then Offboard.
The steps
| Step | What happens |
|---|---|
| Block sign-in | Nobody can sign in as them any more |
| Sign out everywhere | Every app and device asks them to sign in again |
| Remove from groups | Out of Microsoft 365 and security groups. Dynamic groups, groups synced from on-premises and distribution lists are left and say why |
| Remove licences | Every licence comes off. Convert the mailbox to shared first if colleagues need the mail: an unlicensed user mailbox is deleted after 30 days |
| Hide from the address list, convert to shared, forward mail | Exchange Online steps |
Each step runs even if an earlier one couldn't (a group that can't be changed never leaves someone signed in), and the result lists every step's outcome. It's kept in the tenant's history.
What needs Exchange
Hiding from the address list, converting the mailbox to shared, forwarding mail and distribution lists are Exchange Online's. They run through Revo's PowerShell runner once it's set up for your workspace; until then they're skipped with a note, and you do them in the Exchange admin center.
Demo tenants
On a demo tenant offboarding changes only the sample data and says "Demo tenant: nothing was changed".