Skip to main content
Bulk Staff Offboarding closes down several leavers at once: it blocks their sign-in, signs them out everywhere and, if you choose, converts their mailboxes to shared mailboxes. It runs as soon as it’s submitted, or approved, as one run for everyone. Use User Offboarding instead when a leaver needs a set time, a mailbox handover, or their licences and groups removed: it offboards one person with the settings on its Offboarding card. Bulk Staff Offboarding needs Microsoft 365 connected with a GDAP role that can disable users, such as User Administrator, Exchange access to convert mailboxes, and the desktop agent for a client that syncs on-premises Active Directory.

Bulk Staff Offboarding in 49 seconds: what it asks, what it does and what you get.

​
What the form asks

​
What it does

  1. Creates one PSA ticket for the run, if Ticketing is on.
  2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
  3. Disable Account, for each leaver. For a client that syncs on-premises AD, synced accounts are disabled in AD through the desktop agent in one go, then synced; cloud-only accounts are disabled in Microsoft 365.
  4. Revoke Sessions, for each leaver.
  5. Convert To Shared, for each leaver’s mailbox, if Convert mailboxes to shared? is Yes.
With Log actions to the ticket on, each action adds a note to the ticket, for each leaver. The steps run in order in one run, one leaver at a time. If an action fails for a leaver, the run stops there, so the leavers after them and the later steps aren’t done; Executions shows where it stopped.

​
Configure it

Go to Config and click Bulk Staff Offboarding, under Lifecycle. It has no Offboarding card, and User Offboarding’s settings don’t apply to it.

Configure Bulk Staff Offboarding: every option, step by step (1:25).

Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see How configuration works.

​
Troubleshooting

Check User directory filters. Active users only hides accounts whose sign-in is already blocked, and Licensed users only hides people with no licence; untick them on Base config or for that client.
A synced leaver has no on-premises user principal name in Microsoft 365, so nothing was submitted. Check the account’s UPN in AD and that it has synced, then submit again.
AD couldn’t disable the synced accounts the note names, and the run stopped before anything else ran for any leaver. Disable those accounts in AD, then run it again for all the leavers.