User Left the Company? Disable the Entra Account and Revoke Sessions

Published on:
#entra id

When a user leaves the organization, the goal is to remove access immediately.

In Microsoft Entra ID, disabling the account alone is not always enough, because active tokens may still be valid for a while. That is why the real security step is to revoke sessions as well.

Find the User

Go to:

Entra ID > Users

Then select the user account that needs to be offboarded.

Example:

John Doe

Microsoft Entra ID user list showing selectable user accounts

Open the User Profile

Inside the user profile, you can review the main account details, including:

  • identity details
  • authentication state
  • session information

New user profile screenshot showing account properties and authentication options

Disable the User Account

Set:

Account enabled -> False

This blocks new sign-ins and stops the account from being used for future authentication.

User account settings showing the account enabled option set to false

Revoke Sessions

Now perform the session invalidation:

Revoke sessions

This action invalidates active refresh tokens and forces the user to sign in again. In practice, that immediately cuts off access to services such as Outlook, Teams, and the Azure portal.

User profile action showing the revoke sessions option

Enterprise Offboarding Context

In real environments, this is usually part of a structured offboarding flow:

  • disable the account to block new access
  • revoke sessions to invalidate active access
  • remove group memberships
  • remove app role assignments
  • optionally delete or archive the account

Result

After these actions:

  • the user cannot sign in anymore
  • active sessions are invalidated
  • access is fully cut off across services
  • the account can remain for audit and compliance purposes