Disabling a User Account in Active Directory and Microsoft 365

Introduction:

This guide outlines the steps for disabling a user account in both Active Directory (AD) and the Microsoft 365 Admin Center. Disabling accounts promptly helps maintain security, prevent unauthorized access, and manage user lifecycle events such as terminations or leaves of absence.

Process Description:

The objective of this process is to safely and effectively disable user accounts in both on-premises Active Directory and Microsoft 365 environments. This ensures the user no longer has access to internal resources or cloud-based services, reducing security risks and supporting compliance requirements.

Prerequisites:

• Administrative access to Active Directory Users and Computers (ADUC).

• Global Administrator or User Management permissions in Microsoft 365 Admin Center.

• Knowledge of the user’s account name or email address.

Gathering Materials/Resources:

• Access to a domain-joined workstation with ADUC installed.

• Access to the Microsoft 365 Admin Center via a web browser.

• User account details (e.g., username, email, OU location).

Step-by-Step Instructions:

Part 1: Disabling a User Account in Active Directory (On-Premises)

1. Log onto WTVWDCPROD1 or WTVWDCPROD2 with appropriate Admin credentials. Open Active Directory Users and Computers (ADUC):

   • Click Start, search for "Active Directory Users and Computers", and open the application.

2. Navigate to the User’s Organizational Unit (OU):

   • In the left pane, expand the domain and browse to the appropriate OU where the user account is located.

3. Locate the User Account:

   • In the right pane, find and select the user account.

4. Disable the Account:

   • Right-click the user and select "Disable Account"

5. Confirm the Action:

   • The account icon will display a down arrow, indicating it is disabled.

Part 2: Disabling a User Account in Microsoft 365 Admin Center

1. Sign in to Microsoft 365 Admin Center:

   • Go to https://admin.microsoft.com and log in with appropriate admin credentials.

2. Navigate to Active Users:

   • Click Users > Active users in the left-hand navigation pane.

3. Search for the User:

   • Use the search bar to locate the user account.

4. Open the User Profile:

   • Click on the user’s name to view their account details.

5. Block Sign-In:

   • Under the Account section, click Edit beside Block sign-in.

   • Select "Block this user from signing in" and then click Save changes.

6. Optional – Remove Licenses or Reset Password:

   • As needed, you can remove licenses, reset the password, or initiate a sign-out from all sessions.

Tips and Best Practices:

• For hybrid environments, remember that changes in AD may take time to sync with Microsoft 365 (via Azure AD Connect).

• Always verify that the account is successfully disabled in both systems.

• For time-sensitive terminations, block sign-in in Microsoft 365 first, then disable in AD to ensure cloud access is cut off immediately.

Next Steps:

• Notify relevant department supervisors that the account has been disabled.

• If applicable, begin data archival or mailbox delegation processes.

• Schedule account deletion based on your organization’s retention policy.

Additional Information:

• Microsoft 365 Admin Center Help: https://learn.microsoft.com/en-us/microsoft-365/admin/

• Active Directory Management Guide: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds

Disclaimer:

This guide is intended for use by IT administrators familiar with Active Directory and Microsoft 365.