License removal with Okta User Provisioning option for Office365 - License/Role Management only. Does it work? Skip to main content
https://support.okta.com/help/answers?id=906f0000000i0uhiak&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fanswers
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Ask Search:
apireadonly localapireadonly local 

License removal with Okta User Provisioning option for Office365 - License/Role Management only. Does it work?

If we use Okta User Provisioning option for Office365 - License/Role Management only, does Okta remove the license in Office365 when user is remove access to the app in Okta? We tested it and it looks like assigning license works correctly but there is no removal of license when user access to the app is removed on Okta side. 
Best Answer chosen by Niki (Okta, Inc.) 
Gabriel SrokaGabriel Sroka (Okta, Inc.)
Hi Tien
We don't remove the Office 365 license. This article:
https://support.okta.com/help/articles/Knowledge_Article/Office365-Deployment-Guide
explains why:
Deactivate Users – Okta automatically creates Office 365 accounts when a user is assigned to the Okta Office 365 app. If you un-assign the user from the app, Okta will switch the Office 365 account’s sign in status from Allowed to Blocked. Their Office 365 license will remain. The reason we just switch this to Blocked is that by un-assigning the license, you also delete all user data (emails, OneDrive files) associated with the account.

All Answers

Gabriel SrokaGabriel Sroka (Okta, Inc.)
Hi Tien
We don't remove the Office 365 license. This article:
https://support.okta.com/help/articles/Knowledge_Article/Office365-Deployment-Guide
explains why:
Deactivate Users – Okta automatically creates Office 365 accounts when a user is assigned to the Okta Office 365 app. If you un-assign the user from the app, Okta will switch the Office 365 account’s sign in status from Allowed to Blocked. Their Office 365 license will remain. The reason we just switch this to Blocked is that by un-assigning the license, you also delete all user data (emails, OneDrive files) associated with the account.
This was selected as the best answer
Jody TyrusJody Tyrus
Is it possible to get an update on this? Removing only the license but NOT deleting the account does not delete OneDrive files, email, etc.  The data is still accessible if the user is in a Blocked/Unlicensed state.  I've confirmed this within the product for an account that was disabled 90 days ago.  So --- can Okta be set up to revoke applicaiton access AND remove existing license?
Trey McGlaunTrey McGlaun
I agree.  We need to be able to remove the license as well.  While we can script it to release the license it would be much better to have the option in Okta and eliminate that extra step.
Jason NashJason Nash
Same here. I would also like to see the ability to enable the de-provisioning of 365 licenses.
Nicole DotyNicole Doty
We are seeing it work for us.  License/role only, we remove the user from the group, the license is removed from Okta.  This assumes the user is still active, if the user is termed, yeah, we have the same problem. We do not however, sync our users through Okta to O365, we use ADConnect for that (which controls the active/deactive state of the user in O365)
Joshua PetherbridgeJoshua Petherbridge
There was a beta program for doing exactly what everyone here wants:
https://oktabeta.zendesk.com/hc/en-us/articles/115005434408-Enhanced-Offboarding-for-Office-365
No idea what happened at the end of the beta though. Prehaps a comment from someone who knows would help everyone who ends up on this page: google search seems to like it a lot.
Jamie McDonnellJamie McDonnell (Okta, Inc.)
Hi All, just found this thread and see there wasn't an answer provided, apologies.  The Enhanced Offboarding functionality has now moved to EA (Early Adoption) so if you're interested in testing it then please log a support ticket and request they switch on the functionality for you.
Thanks
Van HuynhVan Huynh
Hi Jamie,

Do you have any links that we can read up on this EA feature?  It's a highly desired function in our org as well but we'd like to read over the details before requesting the functionality be enabled.