PowerShell Offboarding Script

Automates the full user offboarding process across a hybrid Active Directory and Microsoft 365 environment.

What It Does

Active Directory

• Removes group memberships (configurable keep list)
• Disables the AD account
• Appends an NLE date tag to the user description
• Hides the user from the Global Address List
• Moves the account to a Disabled Users OU

Microsoft 365

• Blocks sign-in and revokes active sessions
• Removes M365 and Azure AD group memberships
• Adds user to designated disabled user groups
• Enables out-of-office auto-reply (internal and external)
• Converts mailbox to shared mailbox
• Removes direct licenses

Requirements

• Active Directory PowerShell module
• ExchangeOnlineManagement module
• Microsoft.Graph PowerShell module
• Appropriate admin permissions in both AD and M365

Usage

Update the configuration block at the top of the script with your environment values, then run it and enter the username when prompted.