Azure AD account expiration date

[pema012]

We are in need of having expiration date for Azure AD User accounts. How do we acomplish that?

[#2]

No such attribute in Azure AD, you can use a custom workflow/script instead.

[#3]

Thanks Vasil,

I know a lot of companies use this in Windows Active Directory for short term employees or consultants. My reaction in this community is rather due to the lack of funcionality i MS Azure AD.
I will fix my problem with custom workflows but it seems unnecessary to me. Better if Microsoft copies this attribute from Windows Active Directory i think. I understand copying functionality from Windows AD is not really how they do it but it can't be impossible for them to build it.

Again, thanks for your response.

[#4]

@pema012

Like Vasil indeed states, there is no feature or attribute that fixes this issue.

Tip, if you have contractors, partners, or external accounts, I would recommend you using Access reviews. More information about this can be found in my blog post:

https://www.bilalelhaddouchi.nl/index.php/2021/09/30/blog-3-of-4-azure-ad-access-reviews/

[#5]

Thanks BilaelHadd,

Unfortunatley we will not engage in Azure AD P2 license.

[#6 · Accepted solution]

In the end I solved my issue by creating a list in Sharepoint online containing user accounts object ID and the last day of employment as a date.

Then in Microsoft Power Automate I created a flow running every night checking if any records in the list are the same or earlier than today and if so setting AzureAD account to be disabled in Azure AD. When on it I also remove the account from the Azure AD security group providing Microsoft 365 licenses.

So by not having account expire date in Azure AD in the end was giving me the opportunity to do more. Thanks Microsoft. :D

[#7]

Azure AD doesn't support for setting expiration date for Azure AD accounts currently. currently we use access review from Identity governance and set a quarterly review to validate the user accounts. You can also use access packages for privilege's users you have an option to define the "Maximum allowed eligible duration is permanent." or make them eligible and define the maximum JIT duration