Complete User Deactivation Script for O365 using Powershell

[LegacyPulsar]

Morning all,

 

I've previously only posted questions here, but I've been working on something for my organisation which may be of use to some of you here, or which could (probably very likely) be improved upon by those of you here who are much better at Powershell than I am.

 

We've long had the issue of clearing up users who have left the organisation. This involves disabling/removing them from the local AD, as well as a host of connected services such as CPOMs and the RM Unify platform. However, the most troublesome platform I've found to completely eliminate a user on is O365 (without going through both the O365 Admin Center ​an​ Exchange Admin and toggling options individually). Because we use RM Unify as our federated service to sync AD users to O365 (which appears to be a one-way sync: it doesn't deactivate users who are removed from AD), we find that gets in the way of deactivating users completely and so I've been looking for Powershell commands that would do the job for me using just the user's UPN, as well as remove/Account-wipe any synced mobile devices. While I've not found any single command or pre-existing script to do what I want, I've combined many different cmdlets together to do the job of deactivating the user, removing any active O365 sessions, completely disabling any potential to reconnect to their account (overkill, I know) and then wiping their exchange account from any synced mobile devices.

 

Now I am hopeless at creating Powershell scripts, but I have no qualms about simply copy/pasting commands from a Notepad file into an active Powershell session connected to both MSolService and AzureAD sessions. I leave the scripting and .ps1 file making to the people who are good at that, but hopefully this may help a few people who have the same issue as me. All in all you just have to replace the user name throughout (a quick Ctrl+H job in Notepad), and then copy/paste their Mobile Device Identity(ies) into the final part of the script before it's run. For someone like me, who may only be deactivating up to 5 users at a time, it's ideal.

 

So here's the 'script'. Hopefully it is of some use to some of you. If anyone has any improvements to make, please let those be known so it can be added. Some of these commands may be considered overkill or do the same job as others, but I'd rather be safe than sorry and - as I said - I'm a proper novice when it comes to Powershell.

 

---------------------------------------------------------------------------------

Set-CASMailbox -Identity "[email protected]" -OWAforDevicesEnabled $false -OWAEnabled $false -ActiveSyncEnabled $false -ActiveSyncAllowedDeviceIDs $null -PopEnabled $False -ImapEnabled $False -MAPIEnabled $False -EWSEnabled $False -EwsAllowOutlook $False -EwsAllowMacOutlook $False -OutlookMobileEnabled $False -UniversalOutlookEnabled $False -SmtpClientAuthenticationDisabled $true
Set-Mailbox -Identity [email protected] -HiddenFromAddressListsEnabled $true
Get-AzureADUser -SearchString [email protected] | Revoke-AzureADUserAllRefreshToken
Set-AzureADUser -ObjectID "[email protected]" -AccountEnabled $false
Get-MobileDevice -mailbox "[email protected]"

 

Once you've run the Get-MobileDevice command at the end of the above, you then copy and paste the Identity field (looks something like

user\ExchangeActiveSyncDevices\Hx?Outlook?BDF512GV688A8FB7648F197FGE7

​) into the following final bit of script.

Clear-MobileDevice -Identity [Device.Identity] -AccountOnly

 

Note that I only perform an AccountOnly wipe of their device as many of our staff access O365 emails through their own personal devices rather than school-supplied ones. You can remove the -AccountOnly switch to wipe all data from the device, however.

 

---------------------------------------------------------------------------------

 

I hope that's of some use to someone else It is certainly making my life easier!