I'm looking for the quickest way to cut a user's access to their Exchange Online mailbox without waiting for sessions to end or expire. Previously, in our old system, deleting a user's mailbox would instantly block access but I'm not sure how to achieve that with the current setup.
5 Answers
If the user is using Outlook with an OST file, there's a chance they could still access previous emails quickly unless you ensure everything is wiped or convert the account afterwards.
A solid method is blocking sign-ins, revoking sessions, and changing the user's password. This combo generally works to remove access quickly. If you are using MFA, don't forget to clear that too to be extra safe.
The best approach is to block sign-in and revoke sessions directly in the 365 admin portal. Just search for the user in the portal, and you should be able to take care of it right there. Multiple users here reported it works well too, although there might be occasional delays.
That's what I've been doing too, but during my last test, it felt like there were still some delays of about 15 minutes. Not sure if it's improved since then.
Usually, it seems pretty instant, but always good to double-check that everything is working as expected!
You should definitely disable the account and revoke sessions in Entra as a starting point. After that, convert the mailbox to a shared mailbox if you need to keep the data around. This has worked for me without any major hitches.
Just a heads up, you must be cautious about the size limit for shared mailboxes. If the mailbox is over 50GB, you'll need to keep the license!
For immediate removal, I suggest that you first disable the account, change the password, and then revoke sessions via Entra. It's effective, and I usually follow it up by rebooting devices via my management tools if they're online.
That's true! If you have phishing-resistant MFA, remove those settings since the password change will no longer apply.