Home

Hybrid Deployment - Automate User Deletion - Remove-MSOLUser

%3CLINGO-SUB%20id%3D%22lingo-sub-229826%22%20slang%3D%22en-US%22%3EHybrid%20Deployment%20-%20Automate%20User%20Deletion%20-%20Remove-MSOLUser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-229826%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20currently%20working%20on%20a%20workflow%20that%20will%20restore%20an%20MSOL%20user%20and%20assign%20permissions%20to%20OneDrive%20and%20Exchange%20Online.%26nbsp%3B%20This%20piece%20is%20worked%20out%2C%20converting%20to%20cloud%20only%20object.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20snag%20we've%20run%20into%20is%20trying%20to%20have%20the%20user%20automatically%20placed%20back%20into%20a%20soft%20deleted%20state%20after%20X%20amount%20of%20days.%26nbsp%3B%20Is%20there%20a%20workflow%20based%20on%20the%20%22SoftDeletionTimestamp%22%20attribute%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20currently%20setting%20a%20custom%20attribute%20and%20running%20a%20scheduled%20task%20to%20remove-MSOLUser%20if%20that%20attribute%20is%20greater%20than%20X%20Days.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-229826%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EIdentity%20Management%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-234696%22%20slang%3D%22en-US%22%3ERe%3A%20Hybrid%20Deployment%20-%20Automate%20User%20Deletion%20-%20Remove-MSOLUser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-234696%22%20slang%3D%22en-US%22%3E%3CP%3ESorry%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F81821%22%20target%3D%22_blank%22%3E%40Kohen%20Dubeau%3C%2FA%3E%2C%20you%20can't%20set%20the%20SoftDeletedTimeStamp%20manually.%20So%2C%20you%20either%20have%20to%20keep%20the%20license%20for%20a%20longer%20period%2C%20or%20use%20retention%20policies%20for%20the%20data.%20You%20can%20also%20check%20my%20%3CA%20href%3D%22http%3A%2F%2Fo365blog.com%2Fpost%2Finactive-mailboxes%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eblog%20post%3C%2FA%3E%20about%20using%20inactive%20mail%20boxes.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-234685%22%20slang%3D%22en-US%22%3ERe%3A%20Hybrid%20Deployment%20-%20Automate%20User%20Deletion%20-%20Remove-MSOLUser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-234685%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F5953%22%20target%3D%22_blank%22%3E%40Nestori%20Syynimaa%3C%2FA%3E%26nbsp%3B%20Thank%20you.%20I'm%20familiar%20with%20the%20process%20to%20restore%20and%20set%20the%20various%20permissions%20needed.%26nbsp%3B%20The%20problem%20we%20are%20trying%20to%20solve%20for%20is%20if%20a%20manager%20request%20to%20have%20access%20for%20more%20than%2030%20days.%26nbsp%3B%20Is%20there%20an%20value%20we%20can%20modify%20and%20a%20workflow%20mark%20the%20user%20for%20deletion%3F%26nbsp%3B%20We%20are%20trying%20to%20avoid%20using%20another%20custom%20attribute.%26nbsp%3B%3C%2FP%3E%3CP%3ECould%20we%20possibly%20use%20the%20%22SoftDeletedTimeStamp%22%3F%26nbsp%3B%20Update%20this%20to%20the%20date%20we%20would%20like%20the%20account%20to%20be%20removed.%26nbsp%3B%20If%20there%20is%20no%20built%20in%20workflow%2C%20I%20can%26nbsp%3Baccept%20that%20as%20a%20take%20away.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-234571%22%20slang%3D%22en-US%22%3ERe%3A%20Hybrid%20Deployment%20-%20Automate%20User%20Deletion%20-%20Remove-MSOLUser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-234571%22%20slang%3D%22en-US%22%3E%3CP%3EJust%20clear%20the%20immutableId%20attribute%20which%20removes%20the%20link%20to%20on-prem%20user.%3C%2FP%3E%3CP%3EAfter%20you've%20moved%20the%20user%20out%20of%20sync%20scope%2C%20run%20the%20following%20commands%20to%20remove%20the%20immutableId%20and%20recover%20the%20user%3A%3C%2FP%3E%3CPRE%3EGet-MsolUser%20-UserPrincipalName%20user%40company.com%20-ReturnDeletedUsers%20%7C%20Set-MsolUser%20-ImmutableId%20%22%22%3CBR%20%2F%3EGet-MsolUser%20-UserPrincipalName%20user%40company.com%20-ReturnDeletedUsers%20%7C%20Restore-MsolUser%3C%2FPRE%3E%3CP%3EThere%20are%20no%20workflow%20to%20automatically%20delete%20the%20user%20after%20xx%20days.%20However%2C%20if%2030%20days%20is%20enough%2C%20you%20can%20simply%20give%20managers%20access%20to%20user's%20mailbox%20and%20OneDrive.%20This%20way%20they%20can%20be%20accessed%20even%20the%20user%20is%20in%20a%20soft%20deleted%20state.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-234457%22%20slang%3D%22en-US%22%3ERe%3A%20Hybrid%20Deployment%20-%20Automate%20User%20Deletion%20-%20Remove-MSOLUser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-234457%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E%3C%2FP%3E%3CP%3EThe%20users%20are%20being%20removed%20from%20the%20sync%20scope%2C%20i.e.%20moved%20to%20a%20disabled%20users%20OU.%26nbsp%3B%20The%20use%20case%20is%20a%20terminated%20employee%20and%20granting%20a%20manager%20access%20to%20the%20terminated%20employee's%20resources%20for%20XX%20days.%20Once%20the%20XX%20days%20are%20up%20return%20the%20object%20to%20a%20soft%20deleted%20state%20to%20eventually%20be%20deleted%20permanently.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20fully%20understand%20this%20is%20not%20supported.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-233536%22%20slang%3D%22en-US%22%3ERe%3A%20Hybrid%20Deployment%20-%20Automate%20User%20Deletion%20-%20Remove-MSOLUser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-233536%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20are%20not%20providing%20us%20all%20the%20details%20here%2C%20most%20importantly%20why%20and%20how%20are%20you%20deleting%20the%20user%20in%20the%20first%20place%3F%20In%20general%2C%20you%20can%20make%20an%20object%20a%20%22disconnector%22%20by%20removing%20it%20on-premises%20(or%20from%20the%20AAD%20Connect%20scope)%2C%20then%20recovering%20it%20from%20O365.%20But%20that%20object%20is%20still%20stamped%20with%20the%20ImmutableId%2C%20so%20it%20can%20be%20%22reconnected%22%20at%20a%20later%20stage.%20And%20in%20general%2C%20this%20process%20is%20not%20really%20supported%20by%20Microsoft.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Kohen Dubeau
Occasional Contributor

We are currently working on a workflow that will restore an MSOL user and assign permissions to OneDrive and Exchange Online.  This piece is worked out, converting to cloud only object.

 

The snag we've run into is trying to have the user automatically placed back into a soft deleted state after X amount of days.  Is there a workflow based on the "SoftDeletionTimestamp" attribute?

 

We are currently setting a custom attribute and running a scheduled task to remove-MSOLUser if that attribute is greater than X Days.

 

 

5 Replies

You are not providing us all the details here, most importantly why and how are you deleting the user in the first place? In general, you can make an object a "disconnector" by removing it on-premises (or from the AAD Connect scope), then recovering it from O365. But that object is still stamped with the ImmutableId, so it can be "reconnected" at a later stage. And in general, this process is not really supported by Microsoft.

@Vasil Michev

The users are being removed from the sync scope, i.e. moved to a disabled users OU.  The use case is a terminated employee and granting a manager access to the terminated employee's resources for XX days. Once the XX days are up return the object to a soft deleted state to eventually be deleted permanently.

 

 

We fully understand this is not supported. 

Just clear the immutableId attribute which removes the link to on-prem user.

After you've moved the user out of sync scope, run the following commands to remove the immutableId and recover the user:

Get-MsolUser -UserPrincipalName user@company.com -ReturnDeletedUsers | Set-MsolUser -ImmutableId ""
Get-MsolUser -UserPrincipalName user@company.com -ReturnDeletedUsers | Restore-MsolUser

There are no workflow to automatically delete the user after xx days. However, if 30 days is enough, you can simply give managers access to user's mailbox and OneDrive. This way they can be accessed even the user is in a soft deleted state.

@Nestori Syynimaa  Thank you. I'm familiar with the process to restore and set the various permissions needed.  The problem we are trying to solve for is if a manager request to have access for more than 30 days.  Is there an value we can modify and a workflow mark the user for deletion?  We are trying to avoid using another custom attribute. 

Could we possibly use the "SoftDeletedTimeStamp"?  Update this to the date we would like the account to be removed.  If there is no built in workflow, I can accept that as a take away.

Sorry @Kohen Dubeau, you can't set the SoftDeletedTimeStamp manually. So, you either have to keep the license for a longer period, or use retention policies for the data. You can also check my blog post about using inactive mail boxes.

Related Conversations
Extentions Synchronization
Deleted in Discussions on
3 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
36 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
9 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies