Example User onboarding & offboarding Scripts

USE THESE AT YOUR OWN RISK! My scripts include a lot of pauses to make sure you don't make big mistakes with them though. Hit ctrl+c to kill the script if its doing wrong things. :)

---

User Onboarding

---

---

User Offboarding

---

$tenantAdminUsername = "admin@example.com"
$tenantID = "31537af4-6d77-4bb9-a681-d2394888ea26"
$userEmail = "example@example.com"
$forwardingAddress = "example2@example.com"

echo "Connecting to 365..."
Connect-MgGraph -NoWelcome -TenantId $tenantID
Pause
echo "Connecting to exchange online..."
Connect-ExchangeOnline -UserPrincipalName $tenantAdminUsername
Pause
echo "Connecting to MSOnline..."
Connect-MsolService
Pause
$user = Get-MgUser -UserId $userEmail
echo "Making user a shared mailbox..."
Set-Mailbox $userEmail -Type Shared
echo "Waiting 60 seconds for the changes to apply..."
Start-Sleep -Seconds 60
Get-Mailbox -Identity $userEmail | Format-Table Name, RecipientTypeDetails
echo "Made user a shared mailbox, make sure this applied by reading the above. If not, hit ctrl+C, because the script is about to remove their 365 license next"
Pause
echo "Setting up email forwarding..."
Set-Mailbox -Identity $userEmail -DeliverToMailboxAndForward $true -ForwardingSMTPAddress $forwardingAddress
Pause
echo "Continuing after making shared mailbox..."
$businesspremiumlicense = Get-MgSubscribedSku -All | Where SkuPartNumber -eq 'SPB'
Set-MgUserLicense -UserId $userEmail -RemoveLicenses @($businesspremiumlicense.SkuId) -AddLicenses @{}
echo "Revoking sign-in sessions..."
Revoke-MgUserSignInSession -UserId $userEmail
Pause
echo "Blocking sign-in..."
Update-Mguser -UserId $userEmail -AccountEnabled:$false
echo "Resetting MFA..."
$userMfaAccount = Get-MsolUser -UserPrincipalName $userEmail
Reset-MsolStrongAuthenticationMethodByUpn -UserPrincipalName $userMfaAccount.Userprincipalname