> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.
# User Offboarding
> Disables or deletes a leaver's Microsoft 365 account in your client's tenant, hands over their mailbox and removes their access.
User Offboarding closes down a leaver's account at the time you choose: it blocks sign-in, hands their mailbox to colleagues and removes their licences, groups and sign-in methods, as set on the Offboarding card. Use it for every leaver. It needs [Microsoft 365 connected](/core/get-started/connect-microsoft-365), and the [desktop agent](/desktop-agent/overview) for a client that syncs on-premises Active Directory.
## What the form asks
| Field | |
| - | - |
| User to offboard | Required. Picks from the client's users, filtered by User directory filters |
| When should the user be offboarded? | Required. Date, time and timezone; Now, Today 5pm, Tomorrow 9am and Friday 5pm fill it in. A time in the past runs straight away |
| Forward email to | Optional. Only when Forward email is set to Ask on form |
| Grant mailbox access to | Optional. Only when Grant mailbox access is set to Ask on form |
| Set an out-of-office auto-reply? | Only when Ask about an out-of-office auto-reply on the form is ticked: No, Yes — on until removed, or Yes — scheduled, with Auto-reply message, Auto-reply starts and Auto-reply ends |
The handover and out-of-office questions aren't asked when the account action is Delete account.
## What it does
1. Creates a ticket in your PSA, if Ticketing is on.
2. Waits for approval, if Approval is Internal or External.
3. Waits until the time the form gives.
4. Offboarding Audit: with Ticketing on, notes the user's licences, groups and phone numbers on the ticket before anything changes.
5. Disable Account, or Delete Account. For a client that syncs on-premises AD, the account is disabled in AD (never deleted) and moved to Move disabled users to OU, if set.
6. Revoke Sessions, unless a cloud account was deleted.
7. Convert To Shared Mailbox.
8. Set Forwarding, to the person from the form or Always forward to. A copy stays in the mailbox.
9. Grant Mailbox Access (full access), for each person.
10. Remove Licences.
11. Remove From Group, for each group. Dynamic groups are left alone; for a synced client, AD groups are removed through the desktop agent.
12. Reset Password, Reset MFA, Hide From GAL, Remove Inbox Rules and Remove Mobile Devices.
13. Set Out Of Office, if the form asked for one.
14. Renames the account to its archive name, if that's turned on.
Steps 7 to 14 run only when the account action is Disable account, and only the ones the Offboarding card turns on. With Log actions to the ticket on, each action also adds a note to the ticket. If Reset MFA or a group removal fails, the run carries on and the ticket says what to finish by hand.
## Configure it
Go to **Config** and click User Offboarding. The Offboarding card's settings apply once saved, so click **Save changes** before the first run.
| Setting | Where | What it does |
| - | - | - |
| Availability | Header | Internal only, Public form only, Internal + public or Disabled. List on homepage needs a public form. Base config only |
| User to offboard | Form config | The form's one standard field. Keep it Required |
| Add field, Add section | Form config | Your own questions. They're saved with the request and can go in ticket templates. Add client section asks one client only |
| Always asked | Form config | Lists the questions the Execution config adds. Change them on the Offboarding card |
| Approval | Approval | None runs on submit. Internal waits for a teammate or group; External waits for the client's approver, set on each client. Conditional overrides use a different approval when the answers match |
| Ticketing | Ticketing | Create a PSA ticket for each run, with its type, priority, status, subject and body. Log actions to the ticket adds an internal or public note as each action completes |
| User directory filters | User directory filters | Which users the pickers offer: licensed, active, no guests. Users in an Entra role you exclude, or excluded at a client's scope, can't be offboarded from the form |
| Account action | Offboarding | Disable account blocks sign-in and revokes sessions. Delete account removes the account permanently and skips the mailbox handover and account cleanup |
| Convert the leaver's mailbox to a shared mailbox | Offboarding | Converts the mailbox so others can be given access to it. On by default |
| Forward email | Offboarding | Off or Ask on form. Always forward to sets an address used on every run, or when the form's answer is blank |
| Grant mailbox access | Offboarding | Off or Ask on form. Always grant access to adds people on every run; the person from the form is added as well |
| Account cleanup | Offboarding | Reset the password, Reset MFA, Hide from the global address list, Remove inbox rules, Remove mobile devices, Remove all assigned licenses and Remove from all groups. All on by default. Reset MFA needs the UserAuthenticationMethod.ReadWrite.All permission on the Microsoft connection and, under GDAP, Authentication Administrator (Privileged Authentication Administrator for an admin). See [Reset Multi-factor Authentication](/core/workflows/reset-mfa) |
| Rename the account to an archive name | Offboarding | Off by default. Renames the account last, using Archive display name, or `[Archived] - {displayName}` if that's blank |
| Ask about an out-of-office auto-reply on the form | Offboarding | Off by default. Adds the out-of-office questions. Default auto-reply message is used when the form's message is blank |
| Move disabled users to OU | On-premises AD (a synced client) | Where the disabled AD account is moved |
Approval, Ticketing, User directory filters and Offboarding are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see [How configuration works](/core/get-started/configure-user-onboarding#settings-for-each-client).
## Troubleshooting
The user holds an Entra role excluded under User directory filters, or is excluded for this client.
Type an Auto-reply message on the form, or set a Default auto-reply message on the Offboarding card.
With Yes — scheduled, fill in both Auto-reply starts and Auto-reply ends.
## Related
* [Workflow catalogue](/core/reference/workflow-catalogue)
* [Run a workflow](/core/use/run-a-workflow)
* [Executions](/core/use/executions)
* [User Onboarding](/core/workflows/user-onboarding)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.