Clean up after a leaver
AI summary
When employees leave, you need to identify what they hold and remove their access to workspaces, licenses, and account ownership. Rencore Governance finds leavers by account state, such as disabled Entra ID accounts, and you run built-in actions to take back licenses and remove their memberships from groups, teams, and sites. You can set up automation to run this cleanup for every new leaver.
When someone leaves, find what their account still holds and remove the access, licenses and ownership that should go with them.
Before you begin
- Your Rencore role needs the permissions to create policies and automations, and to run built-in actionsBuilt-in actionA built-in action is a ready-made operation you run directly on inventory objects without building an automation, for example adding a user to a Team.Read more. See Rencore roles.
- Microsoft 365Microsoft 365Microsoft 365 is the Microsoft cloud suite of Teams, SharePoint, OneDrive, Exchange and the Office apps.Read more, TeamsMicrosoft TeamsMicrosoft Teams is the Microsoft 365 app for chat, meetings and team collaboration.Read more, SharePoint and OneDriveOneDriveOneDrive is the personal file storage of each Microsoft 365 user. The OneDrive connector of Rencore Governance, part of the Digital Workplace module, inventories every OneDrive with its files, folders and file sharing.Read more are connected and scanned. Add CopilotMicrosoft 365 CopilotMicrosoft 365 Copilot is the AI assistant in the Microsoft 365 apps. Rencore Governance covers it with the Copilot connector, part of the AI & Agents module.Read more to find Copilot licenses on leaver accountsLeaverA leaver is someone who has left your organization but whose account may still hold licenses, workspaces, ownership and OneDrive content.Read more.
- Rencore Governance finds leavers by their account state. A disabled account in Entra IDMicrosoft Entra IDMicrosoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant.Read more is the usual signal.
Steps
Find the leavers and what they hold
- Go to Policies > Policy Options ([…]) > Create Policy.
- In the “Policy Template LibraryTemplate libraryA template library is the catalog of prebuilt items you start from when you add something new in Rencore Governance.Read more”, choose the templates that match your offboarding rule:
- Accounts: Disabled user accounts, Inactive internal users
- Licenses: Disabled user accounts with assigned licenses, Licenses assigned to disabled users, Copilot License Assigned to Disabled Account
- WorkspacesWorkspaceA Workspace is the top-level container in Rencore Governance. It holds the settings, users, roles and connected apps for exactly one Environment, the connected Microsoft 365 tenant.Read more: Groups with disabled user accounts, Teams with a disabled owner account, SharePoint site collections with disabled owners accounts
- OneDrive: OneDrive belongs to a disabled user account, OneDrive contains files from disabled user accounts
- Devices: Devices with disabled user accounts
- Save each policy. See Create a Policy from a Template.
Remove the access
-
For one leaver, open the user in the inventory and run the built-in actions you need. See Executing an Action.
- Remove subscriptions for a user takes back licenses.
- Remove user from a group, Remove user from a Team and Remove user from a SharePoint Site take away workspace access.
- Disable User Account or Delete User Account closes the account. Restore User Account brings back a deleted account.
-
For workspaces where the leaver was an owner, add a new owner first. See Fix Workspaces Without Owners.
-
To run the cleanup on every new leaver, Create a Custom Automation with the trigger “on policy violationViolationA violation is an inventory object that matches the rule of an active policy, such as a Team with no owner.Read more” and the policy “Disabled user accounts with assigned licenses”. Add the action “Add or remove License for a User”, enter the “License Id” of the license to take back (for example, the Copilot license), and set the action to remove. One action removes one license, so add one action per license.
It is good practice to trigger the automation manually for one test account before you connect it to a policy.
What you see
After the next scan, the leaver drops out of the license and workspace policies. The Copilot license policy shows the seats you can give to someone else.
Limits
- Removing a user from a workspace removes direct membership only. Access through a group stays until the user leaves that group.
- Rencore Governance cannot set a manager on an account.
- Movers are covered by periodic workspace reviews, not by an automation. See Create a Review.
Frequently asked questions
How does Rencore Governance identify a leaver?
Rencore Governance finds leavers by their account state. A disabled account in Entra ID is the usual signal.
How do I remove a leaver's licenses automatically?
Create a Custom Automation with the trigger "on policy violation" and the policy "Disabled user accounts with assigned licenses". Add the action "Add or remove License for a User", enter the "License Id", and set the action to remove.
Can one automation action remove several licenses from a leaver?
No. One action removes one license, so add one "Add or remove License for a User" action for each license you want to take back.
Does removing a user from a workspace remove all of their access?
No. Removing a user from a workspace removes direct membership only. Access through a group stays until the user leaves that group.
What should I do before removing a leaver who owns a workspace?
Add a new owner first for workspaces where the leaver was an owner. Then remove the leaver's access.
Was this page helpful?
Thanks for the feedback.
Thanks. What was wrong?