# Departed user accounts are removed promptly

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206782548970-departed-user-accounts-are-removed-promptly
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Microsoft 365 (MS365)](https://support.icompaas.com/support/solutions/folders/f_1781206551953491)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:  
This control ensures that user accounts belonging to departed employees, contractors, or other personnel are promptly removed from Microsoft 365 when access is no longer required. Timely removal of departed user accounts helps prevent unauthorized access to organizational resources and reduces security risks associated with orphaned accounts.

  

Rationale:  
Departed user accounts may retain access to organizational data, applications, and services if not removed promptly. Removing these accounts reduces the risk of unauthorized access, supports effective user lifecycle management, and helps maintain an accurate inventory of active users.

  

Impact:

-   Reduces the risk of unauthorized access by former personnel.
    
-   Improves user lifecycle management and account governance.
    
-   Supports compliance requirements related to access control and user management.
    
-   Ensures only authorized users retain access to organizational resources.
    
-   May require coordination with human resources and management teams during offboarding.
    

  

Default Value:  
Not enforced by default. Administrators must manually block sign-in, remove licenses, and delete user accounts as part of the organization's offboarding process.

  

Remediation

Test Plan

1.  Sign in to the Microsoft Entra admin center with administrative privileges.
    
2.  Navigate to Identity → Users → All users.
    
3.  Review the list of user accounts.
    
4.  Identify users who have departed the organization.
    
5.  Verify that departed user accounts have been deleted or disabled according to organizational policy.
    
6.  Review recently deleted users, if applicable.
    
7.  Verify that departed users no longer have access to Microsoft 365 services.
    
8.  If departed user accounts remain active, follow the Implementation Plan to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Microsoft Entra admin center with administrative privileges.
    
2.  Navigate to Identity → Users → All users.
    
3.  Identify the user account belonging to the departed employee or contractor.
    
4.  Select the user account and enable Block sign-in to immediately prevent access.
    
5.  Remove Microsoft 365 licenses assigned to the user account.
    
6.  Review and transfer ownership of OneDrive files, mailbox content, and other organizational data as required.
    
7.  Remove the user from groups, roles, and application assignments.
    
8.  Delete the user account according to organizational offboarding procedures.
    
9.  Confirm the deletion of the user account.
    
10.  Verify that the departed user no longer has access to Microsoft 365 services.
     

  

Backout Plan:

1.  Sign in to the Microsoft Entra admin center with administrative privileges.
    
2.  Navigate to Identity → Users → Deleted users.
    
3.  Locate the deleted user account.
    
4.  Select Restore user.
    
5.  Reassign licenses, group memberships, and permissions as necessary.
    
6.  Disable Block sign-in if access should be restored.
    
7.  Verify that the restored user account functions according to organizational requirements.
    

  

References:

-   [Microsoft Entra User Management Documentation](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-manage-user-profile-info)
    
-   [Microsoft 365 Delete or Restore Users Documentation](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/delete-a-user)
    
-   [Microsoft Entra User Lifecycle Management Documentation  
      
    ](https://learn.microsoft.com/en-us/entra/identity/governance/what-is-identity-governance)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.