<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
Deprovisioning Office365 User Does Not Disable User-Configured Mail Forwarding
Okta Integration Network
Okta Classic Engine
Overview
An Okta administrator may be unaware of email forwarding configured by an Office365 user who is about to be deactivated in Okta. That user's O365 account will be set to "blocked" when deactivated, but any email sent to that user will still be forwarded to their configured forwarding address. This forwarding address will not appear in the Office365 administrator console.
Applies To
  • Office 365
  • Deprovisioning
  • Okta Classic Engine
Cause
Office 365 deprovisioning (either by app unassignment or by Okta user deactivation) does not disable any mail forwarding manually configured by the user. Therefore, any emails sent to the deprovisioned user will continue to be forwarded to the SMTP Forwarding destination.
Solution

NOTE: Okta strongly recommends reaching out to Microsoft before running any of the PowerShell commands in this article.

Removing the Office365 license from a single user is a simple way to stop this behavior. However, this can be tricky when deactivating bulk users.
 

  1. This PowerShell command will provide a list of all users who have an SMTP forwarding address configured. This helps determine which accounts to prioritize when manually removing licenses from Office365.

Get-Mailbox | Where {($.ForwardingSMTPAddress -ne $null) -or ($.ForwardingAddress -ne $null)} | Select Name, ForwardingSMTPAddress, ForwardingAddress, DeliverToMailboxAndForward


NOTE: This command requires the Exchange Online module to be loaded in PowerShell, which is detailed here.
 

  1. The following PowerShell command will find all Office365 designated as “Blocked” and then remove licenses from each of them:

$Blocked = Get-MsolUser -All | Where {$.Blockcredential -like "True" }; $Blocked | foreach {Set-MsolUserLicense -UserPrincipalName $.UserPrincipalName -RemoveLicenses "(AccountSkuId)”}


AccountSkuId refers to the specific license that should be removed and can be found by running
get- msolaccountsku.  This will list the AccountSku’s for all licenses utilized in the tenant.  In some cases, multiple instances of the above command must be run to ensure all types of licenses are removed from Blocked users.

Loading
Deprovisioning Office365 User Does Not Disable User-Configured Mail Forwarding