cipp_offboard_user
Destructive
Queues an irreversible offboarding job for a user. Requires at least one opt-in action; confirm completion in CIPP's Offboarding view.
Instructions
⚠ DESTRUCTIVE — IRREVERSIBLE. Queues CIPP's offboarding job for a user. Every action is opt-in: at least one must be enabled or the call is rejected. Returns once the job is QUEUED — CIPP reports success on task creation, not completion, so confirm the outcome in CIPP's Offboarding view before reporting the account as offboarded. Confirm with the user before invoking.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| OOO | No | Out-of-office auto-reply message to set on the mailbox. Omit to leave the auto-reply unchanged. | |
| userId | Yes | The target user's Azure AD object ID or User Principal Name (UPN, e.g. alice@contoso.com). | |
| forward | No | UPN to forward the user's incoming mail to. Omit to leave forwarding unchanged. | |
| KeepCopy | No | When forwarding, keep a copy of each message in the original mailbox. Only meaningful alongside forward. | |
| ResetPass | No | Reset the account password to a new random value. | |
| DeleteUser | No | ⚠ Delete the account outright. Do not combine with actions that need the account to exist afterwards. | |
| HideFromGAL | No | Hide the mailbox from the Global Address List. | |
| RemoveRules | No | Remove all inbox rules from the mailbox. | |
| RemoveGroups | No | Remove the user from all groups they are a member of. | |
| RemoveMobile | No | Remove the user's registered mobile devices. | |
| tenantFilter | Yes | Tenant domain name or ID to scope the operation. Use 'allTenants' to target every managed tenant. | |
| AccessAutomap | No | UPNs to grant full access to the user's mailbox, automapped into their Outlook. | |
| DisableSignIn | No | Disable the account so the user can no longer sign in. | |
| OnedriveAccess | No | UPNs to grant access to the user's OneDrive. | |
| RemoveLicenses | No | Remove every license assigned to the user. | |
| RevokeSessions | No | Revoke all active sign-in sessions and refresh tokens. | |
| AccessNoAutomap | No | UPNs to grant full access to the user's mailbox without automapping. | |
| ConvertToShared | No | Convert the mailbox to a shared mailbox so it can be retained without a license. | |
| ClearImmutableId | No | Clear the immutable ID, breaking the link to an on-premises AD object. | |
| RemoveMFADevices | No | Remove all registered MFA methods for the user. | |
| disableForwarding | No | Remove any existing forwarding configured on the mailbox. | |
| removePermissions | No | Remove the user's delegated access to other mailboxes across the tenant. | |
| RemoveTeamsPhoneDID | No | Release the Teams phone number (DID) assigned to the user. | |
| removeCalendarInvites | No | Cancel calendar invites the user organised. | |
| DisableOneDriveSharing | No | Revoke sharing links on the user's OneDrive. Requires a recent CIPP build; older ones ignore it. | |
| removeCalendarPermissions | No | Remove the user's permissions on other users' calendars across the tenant. |