Offboarding Puns

When you're dealing with systems that haven't had proper support for years, you're inevitably going to run into landmines.

My boss has been away on sick leave for a while, and it was just extended further. As such, I delegated his approval tasks to myself so we could get the low-impact stuff moving. Part of that was approving people for access to this ancient ordering system. I approve the 30 pending requests and go on with my day.

Today I wake up to a few messages from the new people. No license available! Wait, what? Oh right. We're limited to 4000 licenses.

There is no way we have 4000 active users.

After digging up the database info, it turns out that we have licensed users that last logged on in 2011.

Is there any automated method of cleaning out licenses for offboarded users? No.

Is there any manual way that I can trigger? No.

Did anyone at any point create some way of handling user licenses? Adding/removing licenses in bulk? Anything at all?! No.

Oh, and is there a test or dev environment for the system? Also no.

After double checking that I still have the email from my boss giving me full authority to do whatever I deem necessary with this outdated system, and absolving me from any consequences if it breaks due to the lack of training in the system, I get to work.

SQL Update. All users with a license that have not started a session since 1/1/2020, remove license.

2912 records updated. 1088 users still have a license. Every user I know has logged on recently still has a license.

Servicedesk informed. No issues should arise, but if they do I'm to blame. Post-mortem sent to my boss and scrum master.

Sweating gradually decreasing. The system didn't explode. Another day saved.

TL;DR: Another fire put out by smothering it with napalm.

Found a feature recently In the 365 admin control panel. It was great and now I can't find it. Maybe someone here can help.

For offboarding a user, in one place it allowed me to convert the mailbox to a shared mailbox and add it to a managers mailbox, and set up an auto response to say "X has left the company, please contact Y".

If you've seen it you'll know what I mean. I know I can do these 3 things separately but all in one place was great.

Hey all,

This one is a 'request' I had on our Discord where the target was to ease the workload on offboarding users. I helped the person doing this to create their own custom offboarding script, but figured more people could use some examples. Of course you'll still have to edit this to your own workflow: https://www.cyberdrain.com/automating-with-powershell-quickly-offboarding-a-m365-user/

I've also published a new Tech in 5 minutes video, for how to configure the MFA push functionality I've blogged about recently, you can find that one here: https://www.youtube.com/watch?v=ah8fYAhkJ4o

I hope you all enjoy, and if there's any more questions, sweet nothings, or other requests, let me know!

Edit: thank you for the answers! Wanted to be clear!

Hey.

Have a question how it looks in your organizations? I'd like to provide simple on/offboarding solution for my HR to not mess around with custom scripts. My requirement is:

- some simple form/workflow where HR employee provides data required for user onboarding

- script creates 3rd party accounts like: gsuite, slack, github, salesforce and others via API

Greetings Azure community,

I’ve been digging for weeks to discover how our company can deal with users and devices.

It seems that one of our main issues is what we do when someone either exits the company or returns equipment.

For compliance rules, we have active logged in users and connected devices as a requirement within a Grace period.

The main issue occurs when we retrieve equipment and they become unassigned to a user, thus triggering one of the compliance rule sets and eventually the other when the device is in limbo between users.

For devices, should we be disabling them or removing them from the cloud until next use with the delete function?

I understand that disabling prevents the devices from authenticating with the cloud and accessing resources. Does this also mean it removes it from the compliance rules? I do see that it prevents conditional access pings.

I’m assuming the process would be to Fresh Start (delete data) the device, Disable device and then Disable user.

Appreciate the help.

We recently discovered we need a better way to onboard and offboard our clients employees rather than just being put in through a ticket. We've created a form with our standard checklist of how they would like us to proceed, but we aren't sure how to distribute it. Ideally our main POC of each company would fill it out and send it to us, be realistically we know they'll forget and end up putting in a ticket. Any ideas on how we can distribute our form so we can get complete and timely information for onboarding/offboarding?

For those of you who have a tiered support system, who do you assign onboarding and offboarding users to? Given that it sometimes requires access to systems like ADUC, do you have your level 1 helpdesk guys having access to log into domain controllers? Are you sharing your domain admin accounts or setting up access for each technician?

Happy Friday! I wanted to hear your process on this situation. Fairly new to this situation I could use some knowledge. What steps are you guys taking to off board Azure AD joined devices? I'm looking to keep the Intune connection but remove the users profile and apps from the device.

I've tried offboarding by the user in Microsoft endpoint manager admin center by clicking on the device I want to offboard and press "Fresh Start" without clicking on (Retain user data on device) however when it runs its course the users profile is still there. Having me log into the machine and manually remove the users profile.

Also if I want to redistribute the device to a new office 365 user would I just change the primary user to the new person and have them set up the computer?

Edit: If possible, try not to use shorthand or aliases, I'm still new.

I have a report where I can do see old employees consent to application. I have a backlog I need to remove and want to script this into my term script. I need to do this manually/in script for other process reasons. I know I can do this temporarily/slowly through AzureAD gui.

We recently changed our consent requirements to required admin approval, so that will help a lot on the security front.

I found this page: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal

With this code:

# Store the proper parameters
$user = get-azureaduser -ObjectId <objectId>
$spo = Get-AzureADServicePrincipal -ObjectId <objectId>

#Get the ID of role assignment 
$assignments = Get-AzureADServiceAppRoleAssignment -ObjectId $spo.ObjectId | Where {$_.PrincipalDisplayName -eq $user.DisplayName}

#if you run the following, it will show you what is assigned what
$assignments | Select *

#To remove the App role assignment run the following command.
Remove-AzureADServiceAppRoleAssignment -ObjectId $spo.ObjectId -AppRoleAssignmentId $assignments[assignment #].ObjectId

The problem I need to query all apps for which 1(or list) of users consented.

I stopped at line 2, as this looks to reference a specific App, not all apps.

$user = get-azureaduser -ObjectId <objectId>

#requests objectID of a specific app.
$spo = Get-AzureADServicePrincipal -ObjectId <objectId>

The issue is I can't find a way to query which apps the user is a part of. Or if I am unable to break down

I can't find the command, but I know the flow I need: Find all apps -> Search members for X -> Remove X apps 1-99...

I've been looking for about an hour, so I feel like I'm not close on the verbiage or if this is possible.

I have not used graphAPI, so that might be needed.

Hey there everyone,

So we are a fairly small district that is in the process of switching over to incident IQ this summer. Here is what we have to work with..

• SIS: PowerSchool
• Directory Services: On-Prem Active Directory
  • Sync to Google Workspace
  • Sync to Azure
• LMS: Schoology and SeeSaw (based on grade levels)
• MDM
  • ConfigMgr and Intune in CoManagement Mode
  • JAMF School
  • Google Admin Panel
• Additional systems
  • Classlink
  • OneRoster
  • Infinite Visions
  • Frontlline
    • Absence Management
    • Time and Attendance

What we are trying to do is streamline our onboarding and offboarding workflows. What I would love to do is be able to have something from outside incidentIQ be able to "trigger" the creation of a bundle of tickets that would then be put into a Work Package for onboarding / offboarding based on user type.

I would need separate workflows for

• Students
• Externally Placed Students
• Certified Faculty
• Support Staff

First question,

Is the API Robust enough to be able to execute something like this regardless of difficulty or intermediary systems to perform the work?

Would I need to have an intermediary mechanism that would be able to receive the trigger from the external system and then push into iIQ with the API the various API commands to create each of the individual tickets and then combine all those tickets into a work package?

Any suggestions of wisdom would be appreciated. I will say that personally I work best by reverse engineering something similar, so if anyone can point me into that direction it would be appreciated.

Thanks so much!

Since rolling out 365 in my company, I've not had any users leave the company until now. I would like to grant mailbox access to his boss, set an out of office to tell people he's moved on... Can I remove his license? Any tips?

I'm part of a small MSP, we're using ITGlue, Halo, and Ninja. We're also using Sharepoint currently just as a file share.

I'm tasked with setting up a system for our procedure documentation. There are basic universal steps, and then client specific ones. I'd like to use some form of template that includes the universal steps and is then extended by each client. This way you only need to open the client document and it shows everything you need to do, without having to click links back to the universal steps, they're simply included. This is fine with Word document templates but there's another feature I'd like. I'd like it to function so that when the template changes (i.e. there's a change to a universal step) that all client documents that used that template also change. This way when there is a change in procedure only one document needs to be changed, either the universal template or the client's document.

So if by a slim chance I've made enough sense, does anyone know of a system capable of this? ITGlue documents don't even have any templates at all, and in Sharepoint/Word the changes to a template don't propagate to the files that extended it. Any and all advice is greatly appreciated!

Hi Folks, MSP guy here.

Since I'm offboarding the first bigger client in my career, any suggestions on what to watch out for, I want the handover to be as clean and smooth as possible, serves our reputation as well.

All systems are up to date, as well as the documentation. I even updated the network diagrams, made sure the client also has all the configuration backups. Anything you would add?

I'm working in a people analytics function for a mid-sized organization in London, UK. Over the last couple of years, we've had occasional discussions about redesigning our offboarding process. Internally we've discussed this quite often, liked the idea, but failed to make it a priority.

Last week I stumbled on this article from the Harvard Business Review and I realized that a lot of this holds true for our organization as well. In some areas, we could improve (knowing why people leave) in other domains things are already good but could be even better (6% of new hires are already boomerang hires).

I'm currently preparing a proposal for our VP people about redesigning our offboarding process. I found some strategies here, but would really love to hear about your experiences with offboarding. Do you see offboarding as just as important as onboarding?

London, UK

Hello all,

What is the best way or best practice to off-board a GSuite in the event of user leaving the company?

Let me know if you need any further info from me.

Thank you for all your help.

I'm fairly fresh to SysAdmin work and currently manage 30 users. I've had a real crack at Googling this question but I'm not sure I'm using the right search terms.

The org uses GSuite – is there a way (perhaps with Cloud Directory/SAML) to sync GSuite user creation with other apps?

I'd love to be able to click Create User in GSuite and then have that same user be created in apps like:

• Notion

• Slack

• Adobe Creative Suite (if required)

• Etc

Or is this a pipedream that will come down to API endpoints for both Google and each app?

Hey all!

Need some help navigating a tricky situation.

As of now, I am for sure getting laid off on 11/02. I have already received my severance letter in my e-mail outlining my package and benefits and this date in writing, I just cannot sign it until the end date.

Another internal position was dangled in front of me fort he last two months despite my initial answer being that I was not interested, but things have lead to me being open to it just to see what they could do for me. My company's recruiting department dragged their feet in posting the job listing and it didn't actually go up on their site until after I had received the severance letter outlining my end date. I applied for the job, but our company's onboarding process takes usually two weeks minimum. Meaning, the new role wouldn't start until after my end date. My understanding is that this means I am entitled to my full severance and still have the possibility of accepting this new position (please let me know if I am wrong).

Now today, my boss messages me asking if they were to able to move my end date until the end of November if I would be interested in that. This seems like a very obvious ploy to get me out of receiving my full severance in the event that they choose to go with me for the new role? Nothing has been presented to me in official writing or anything. This is an obvious reject, right?

Thank you for any and all advice :)

I am joining a new company soon. During the intro from IT Head, I heard they have no formal HR system in place because its a very old Accounting company and "things" have been working for them for past 40 years and management do not want to spend dollars. About 250 users and 50 + seasonal staff that comes and goes every year.

However, they are on the M365 Business premium plan which include the entire office suite + Intune etc.

I currently have basic knowledge on Office 365 and some of the common apps used such as outlook, word, Sway, excel etc etc.

Are there any apps in Office 365 I can learn and leverage that will give me grounds to build or work towards the following tasks:

1. Employee / Temp staff Onboarding and Offboarding IT processes - Including checklist, laptops, desktops, phones. Making streamlined processes etc so this onboarding and offboarding of task can be handled effectively.
2. HR system, even basic functionalities that can possibly be build if I can leverage few Software developers to help me out.

Thanks in advance for any suggestions!

Edit: I'm posting for Beth Houghton (daughter of passengers) - I'm posting on her behalf and am NOT her:

"I’m hoping this will go viral and I’ve already contacted news outlets.

My dad and stepmother were on the ship off the San Francisco coast. I have news that I think must be brought to the public attention - everything that’s happened since they’ve gotten off the ship, and what they’ve been through. I just talk to my dad and what they’ve gone through is unbelievable. I’ll sum up:

1. They waited for 11 hours past when they were told that they would be taken off the ship, finally getting off the ship at 5:30 PM.

2. Once they disembarked, there was a minimal health screening, that included only taking their temperatures, and a couple of questions.

3. They were loaded onto buses, and made their way to Travis Air Force Base. Then, they waited for two hours to get off the bus. There were no services, and no one was allowed to go to the bathroom while they were waiting.

4. Once they got off the bus, they were told that all of the luggage for 900 passengers have been unloaded and dropped in a parking lot. The parking lot had no lights and there was no organization to the luggage. My dad, who is 78 years old, with severe asthma, had to look for 40 minutes for his luggage. He got his luggage and headed back to the bus. In the meantime, my stepmother was able to grab two sandwiches.

5. All passengers then had to load their own luggage back onto another bus. They boarded the bus, and waited 1 1/2 hours to leave. They arrive shortly after at Travis Air Force Base.

6. Approximately 300 passengers were taken to a hotel, where there was food, services, and staff. The other 600 passengers were taken to condominiums on the Air Force Base, including my father and stepmother.

7. When they got off the bus, They were asked two health questions, whether they had a fever – for which they were not tested – and whether they were coughing. That was it. No one took their temperature. After that, there were no staff members, or help to find their individual units. It was very dark, and nearly midnight. And my dad and stepmother finally found their rooms, they entered and found absolutely nothing in the unit. There were not even water glasses, or cups with which to get a drink of water.

8. They fell asleep around 2 AM and woke, and were served no breakfast, no coffee, or anything else. A neighbor brought my dad and stepmom two plastic cups. As of 1 PM today, Wednesd

Hi all,

I'd like to know if it's possible to configure an offboarding script to action certain tasks based on X amount of days after being triggered.

Our org has three offboarding phases each 30 days apart.

A user is offboarded: Day 1: (when the script would be manually triggered) AD account is disabled. O365 account sign in blocked. Description updated. Out of office message configured for mailbox. (Some other things happen)

Day 30: (here's where it gets interesting and where my question comes into play) Remove O365 license Remove user from Distribution Lists (some other things happen)

Day 60: (same as above. Looking to trigger tasks automatically after 60 days since commencing) Remove all remaining group membership Delete AD Account

I can script these tasks individually but I'd like to know if the ones that take place on Day 30 and day 60 are possible to 'schedule' upon triggering the script once on day 1.

Thanks in advance :)

After WWII and after the reunification, Germany regained in the first instance, and kept in the second, a democratic political structure.

In both instances, they brought people into the fold who had ideological positions incompatible with democracy, and yet maintained a functioning federal democracy.

I know that making the comparison between these ideological frameworks is not entirely accurate or a 1:1 match between them, but I do wonder if there are any lessons we can take.

Considering that you grew up in a nation that went through that process twice, what advice do you have for us for how to deal with millions of citizens who've been fed a diet of propaganda for decades, who have participated actively in ingesting this propaganda, and who have in defeat refused to abandon their ideological positions?

I'm not sure reunification actually tracks here, because I understand the GDR/DDR faced significant internal opposition, but I do wonder if some of the lessons learned there might be helpful to the United States going forward.

Thanks in advance for your time.

Hello coinbase,

I quite afraid i'll lose all my money on coinbase because the restriction. My account already restricted from December and not yet solved. But now you give me a notification my account will be marked as offboarding soon. This is really too much coinbase.

I already try open a new ticket and try re-reply your last support email but till now no response. Please help me out of this problem. Its already been stresfull days for me waiting for a response from support.

Update#1 : Coinbase Support already replied my thread, Let's see when ill get a response from support after my case has been re-escalated, Still waiting for a response till now.

Honestly. Is "leaving" such a difficult concept for their HR department to get to grips with?

We had to let some people go yesterday, and it seems like O365 isn't really meeting the expectation of the business when it comes to immediate offboarding. Am I going about things the best way to achieve that? Our office is fully remote.

We would like to cut off access to e-mail/sharepoint/teams/etc immediately. Up until now, my understanding is that the best way to do this is to change password and then initiate signout, from the O365 admin gui. I don't feel like that was effective yesterday.

One employee remained as "Available" in Teams for almost an hour afterwards. O365 says that another user successfully logged in 1.5 hours later (how??).

I understand that the service needs to reach out to user devices, maybe waiting for devices to attempt to refresh a token... but then is there really no way to immediately cut off user access to O365 services? I need to be able to explain this to management, potentially, so I'd like to get a clearer understanding of why this feature is missing, or alternative options.

A group chat with some fellows in the field had us wondering..

How manual (or automatic) of a process do you have once you receive a user termination request?

For small orgs, it's probably a simple AD user account disable and making sure they don't steal their desktop, but for larger orgs when the user has apps without SSO, home equipment, multiple departments have to cut them off from certain things, etc,

How do you do it?

Hey, Sysadmins! What's your process regarding AD account management and email for off-boarded employees?

For example, we move offboarded employee AD accounts to a specific OU, deactivate their account, and change their passwords. We provide their manager access to the termed employee's email account to monitor emails (including new inbound email) while the employee's work is transitioned to other employees. I don't like maintaining the accounts after the employee is offboarded, but I understand the business need to provide mail file access to the manager and to allow inbound mail addressed to the former employee. How do you handle this?

Hey ho,

TL;DR: I'm looking for a tech (python backend) or sales automation/growth cofounder located in western Europe.

Not long ago, I started an HR tech project to help companies implement processes for employee offboarding. The goal is to help companies develop new data-driven capabilities, as well as to simplify and professionalize processes.

I've already built the first version and there's some early interest. On top of that, I found a network of investors who would be willing to support the project. The network is comprised of successful tech entrepreneurs as well as execs from companies such as Google.

Currently, I'm doing everything by myself and I was able to achieve a good amount of progress. But truth be told: I'm getting to the point where everything has become overwhelming and I'm just not able to get the results and outcomes that I want. Sales processes, demos, fundraising, IT compliance, backend- & frontend architectures, HR processes, and content ... it's a lot!

That's where you come in. I'd love to talk to potential cofounders that have a tech background (Django) or a background in sales automation/growth. I would love for you to have some amount of experience in the B2B space as well as the involved processes (especially IT compliance/audits/tenant separation). I'm located in Germany (Berlin) and have made some bad experiences with working in different time zones. But it would be very, very great if you're at least located in one of the target markets (USA, Canada, UK, Ireland, Germany).

I'm looking forward to talking to you!

Use this thread to continue reminder discussion when thread is fucked, or you want to announce yourself to others. e.g. Did OP deliver or was OP correct?

Hi All

When we offboard terminated employee accounts in 365 we do the usual reset pw, block sign in, convert to shared, remove licensing, etc. which has been the norm, but today I got the question about stopping email delivery to this shared mailbox after a grace period. Usually I'd just leave the shared mailbox...because why not? It's free and a much better archive solution than PST...just set a limit and leave an OOO

But I started looking in to this a little further at the clients request, seems like the best solution would be to change their email (SMTP) address. There are also the options of deleting the mailbox and recovering it to a different account, or mail delivery restrictions but I wanted to see how the rest of you guys handle this. I am open to all advice and suggestions!

Hi,

Making a simple "pick from the choices" script for offboarding users from O365. The problem is that $UPN doesn't represent the choice that comes from hitting "1" and so prints the wrong user to the console.

Function New-UserRemoval {
 
         #Connect-MBX03
 
    Write-Host "Please select the input Type:"

    Write-Host "[1] Single user?"

    Write-Host "[2] CSV File with the header 'Users' and their UPNs?"
 
    $TypeOfInput = Read-Host "Type"
 
     switch ($TypeOfInput) {
    
    "1" {$UPN = Read-Host "Enter UPN"}

    "2" {$TypeOfInput1 = Import-Csv "$home\input.csv"}

    default {"You cannot use this method! Re-run script!";return}}

    Write-Host "Do you want to continue with the user selection?"

    If ($TypeOfInput -eq '1') { "You have selected $UPN" }

    Else {$typeofinput1.Users}

    Start-Sleep -Seconds 1

    Start-Sleep -Seconds 1

    Write-Host "[1] Yes!"

    Write-Host "[2] Oops, no!"

    $TypeOfInput2 = Read-Host "Continue?"
 
     switch ($TypeOfInput2) {
    
    "1" {$1 = Write-Host "Great, continue!"}

    "2" {$2 = Write-Host "Operation cancelled!";return}

    default {"Out of bounds! Re-run script!";return}}

    If ($TypeOfInput -eq '1') {"Running operation on a single user!"}

    try {

    Write-Host "Deleting user " + $UPN

    Write-Host -ForegroundColor Yellow "Starting to delete $UPN from O365"

    #Remove-MsolUser -ObjectId $UPN -RemoveFromRecycleBin -Force

    #Get-Mailbox -Identity $UPN -SoftDeletedMailbox | Remove-Mailbox -PermanentlyDelete -Force

    #Get-Mailbox -Identity $UPN | Remove-Mailbox -PermanentlyDelete -Force

    $Count = $Null
    $Count = 1

    Write-Host -ForegroundColor Green $UPN "has been removed from O365"
    
    }

    catch {

    $Count = $Null
    $Count = 0
    
    Write-Host "Failed to delete $UPN from MSOL:$($error[0])"

    else ($TypeOfInput -eq '2') {"Running bulk operation!"}

    }

    try {

    ForEach($User in $TypeOfInput1){

    Write-Host -ForegroundColor Red "Starting to delete $TypeOfInput1.Users from O365"

    #Remove-MsolUser -ObjectId $User.Users -RemoveFromRecycleBin -Force

    #Get-Mailbox -Identity $User.Users -So

Found a feature recently In the 365 admin control panel. It was great and now I can't find it. Maybe someone here can help.

For offboarding a user, in one place it allowed me to convert the mailbox to a shared mailbox and add it to a managers mailbox, and set up an auto response to say "X has left the company, please contact Y".

If you've seen it you'll know what I mean. I know I can do these 3 things separately but all in one place was great.