Active Directory Pro
Login Download Free Trial

Offboard Users

This guide shows you how to offboard Active Directory users.

To open it, go to Tools > Users > Offboard users. You need a role that can manage users.

Before you start

  • Microsoft 365 steps need a connected tenant. If you haven't connected one, see Connect Microsoft 365. Without one, the page still offboards the Active Directory account.
  • The page remembers your choices. Every option you tick or untick, the description, and the OU are saved for you and filled in next time. Only the selected accounts are cleared. Settings are kept per domain, because the OU belongs to one domain.

Step 1: Select users

Add the accounts to offboard in any of these ways:

  • Browse AD: opens the account browser. Type in the search box to find users anywhere in the domain, or pick an OU to narrow the search to that OU and the OUs under it.
  • Select CSV: reads account names from a CSV file. The file needs a column with one of these headings: Logon Name (sAMAccountName), sAMAccountName, Username, UserPrincipalName or UPN. A value with an @ in it is treated as a UPN, anything else as a logon name. Other columns are ignored. Names that can't be found are listed under the selection.
  • From User management: on Tools > Users > All users, select one or more accounts and choose Offboard from the toolbar. The Offboard page opens with those accounts already selected.

Remove an account from the list with its X, or use Clear all to start again.

Step 2: Choose the offboarding actions

The actions are in two cards: Active Directory on the left and Microsoft 365 on the right.

Active Directory

Action What it does Ticked by default
Save a record of the account first Saves the account's groups, manager, direct reports and attributes before anything changes. See Saved records. Yes
Disable the account Disables the account so it can't sign in. Yes
Reset the password Sets a random 20 character password that is never shown or stored, so no one knows it. The user isn't asked to change it at next logon. Yes
Hide from the address list Hides the user from the Exchange global address list. No
Remove from all groups Removes the account from every group it is a member of. The primary group (usually Domain Users) stays, because Active Directory requires one. Yes
Clear attributes Clears the attributes you tick: Manager, Email, Telephone, Mobile, Fax and IP phone. No
Set the description Writes a description, for example the date and reason. Left blank, it writes "Offboarded" and today's date. Tick Add to the existing description to keep what was there and add to the end. Yes
Move to an OU Moves the account to the OU you choose, for example a Disabled Users OU. No
Delete the account Deletes the account. This can't be undone from AD Pro Toolkit. When ticked, the move is skipped. No

Microsoft 365

The page finds the user's Microsoft 365 account by their user logon name (UPN), then by their on-premises SID for synced accounts.

Action What it does Ticked by default
Block sign-in Blocks the user from signing in to Microsoft 365, the same as Block sign-in in the admin center. Yes
Sign the user out everywhere Ends all of the user's sessions, so apps already signed in (Outlook, Teams, mobile apps) have to sign in again, which now fails. Yes
Remove from Microsoft 365 groups Removes the user from cloud groups: Microsoft 365 groups, security groups, distribution lists and mail-enabled security groups. Yes
Remove all licenses Removes every license assigned directly to the user. No

Step 3: Run it

The bar at the bottom of the page always shows what will happen, for example "7 actions, 4 in Microsoft 365", or what is still missing before you can run.

  1. Select Offboard N accounts.
  2. Confirm. If Delete the account is ticked, the confirmation says so.
  3. A results window opens and fills in as each account is processed.

The order the steps run in

The order is fixed, so access is cut before anything slower runs:

  1. Save the record (before anything is changed).
  2. Disable the account.
  3. Reset the password.
  4. Microsoft 365: block sign-in, sign out everywhere, remove from groups, remove licenses.
  5. Hide from the address list.
  6. Remove from all groups.
  7. Clear attributes and set the description.
  8. Move to the OU.
  9. Delete the account.

Each account is re-read from Active Directory just before it is processed, so an account moved or renamed since you selected it is still found.

Reading the results

The results window has one row per account:

  • Green check: every step worked.
  • Red !: one or more steps failed. The other steps still ran, so a failed password reset doesn't leave the account in its groups.
  • Grey dash: the account wasn't processed, for example because you cancelled.

Select a finished row to see each step. Failed steps are listed first, with the reason.

Some lines are information rather than failures, and show with a green check:

  • No Microsoft 365 account: the user has no cloud account to offboard.
  • No 365 groups to remove or No 365 licenses to remove: there was nothing to do.

Cancel stops after the account in progress, never part way through one, so no account is left half offboarded.

After you close the window, each account in the Step 1 list keeps a check or warning icon. Hover over it to see the outcome.

Things to know about Microsoft 365

  • Synced accounts and Block sign-in. For accounts synced from Active Directory, AD stays in charge of whether the account is enabled. If you block sign-in but leave the AD account enabled, the next Entra Connect sync can unblock it. Tick Disable the account as well to keep it blocked. The page warns you when this applies.
  • Groups synced from AD are left to Remove from all groups on the Active Directory side, and reach Microsoft 365 at the next sync. Dynamic groups drop the user by themselves.
  • Licenses assigned by a group can't be removed from the user directly. They are removed when the user leaves that group.
  • The mailbox is deleted 30 days after its license is removed. If someone needs the mailbox, convert it to a shared mailbox or export it before you remove the license.

Saved records

When Save a record of the account first is ticked, AD Pro Toolkit keeps a snapshot of the account as it was before offboarding. This is useful when a manager asks which groups a leaver was in, who reported to them, or what their phone number was, after the account has been changed or deleted.

Each record holds:

  • Profile: name, logon name, UPN, job title, department, company, office, manager, description, email, phone numbers, employee ID, address, home folder, profile path, logon script, and when the account was created and last changed.
  • Groups: every group the account was a member of.
  • Direct reports: the people who had this user as their manager.
  • Managed objects: groups and other objects this user was set as the manager of.

To find records, open the Saved records tab at the top of the page. The tab shows how many records there are. Records from the run you just finished are tagged New. The results window also has a View saved records button that takes you straight there.

For each record you can:

  • Open it to see everything it holds.
  • Download it as an Excel workbook with one sheet for each section.
  • Delete it. This can't be undone.

Use the search box to find a record by name or logon name.