Set Up Microsoft Entra Offboarding Actions

Employee offboarding often requires IT teams to act quickly across Microsoft 365 and Microsoft Entra accounts. Admins may need to revoke sign-in sessions, remove app access, reset MFA methods, grant OneDrive access, set Outlook auto-replies, and share calendar access with a manager or replacement user.

AssetSonar’s Microsoft Entra offboarding actions help IT teams run these actions from AssetSonar using a secure Microsoft Graph integration. Once connected, these actions can be used on member records and in structured offboarding workflows to reduce manual effort and close access gaps during employee exits.

This guide walks you through creating a Microsoft Entra app registration, adding Microsoft Graph permissions, connecting the integration in AssetSonar, and running Microsoft Entra offboarding actions.

1. Before you begin

Before setting up Microsoft Entra offboarding actions, make sure you have:

• Microsoft Entra Global Administrator access
• Access to Microsoft Entra app registrations
• Permission to create client secrets
• Permission to grant admin consent for Microsoft Graph application permissions
• AssetSonar members with primary email addresses that match their Microsoft Entra users

Note: You can sync users through Azure AD SCIM Integration: Provision Users. To track cloud software usage and app visibility from Azure AD, see Azure AD Integration: Import Cloud Software Data. 

2. Understand what Microsoft Entra offboarding actions help secure

Microsoft Entra offboarding often includes both account security actions and Microsoft 365 handoff actions. AssetSonar helps admins run these actions from one place.

Offboarding risk	Microsoft Entra action in AssetSonar
The user remains signed in across Microsoft apps and sessions	Revoke Sign-In Sessions
Apps retain delegated access granted on the user’s behalf	Revoke OAuth Permission Grants
MFA methods remain available after offboarding	Remove MFA Authentication Methods
Important OneDrive files are not accessible to a manager or replacement	Grant OneDrive Access
Internal or external contacts continue emailing an unmanaged inbox	Set Email Auto-Reply
Calendar ownership or visibility is lost during handoff	Share Calendar Access

These actions help IT teams standardize Microsoft Entra offboarding and reduce the risk of missed manual steps.

3. Create an app registration in Microsoft Entra

First, create an app registration in Microsoft Entra. AssetSonar uses this app registration to connect with Microsoft Graph and run offboarding actions.

To create the app registration:

1. Log in to the Azure Portal.
2. Go to Microsoft Entra ID → App registrations.
3. Click New registration.
4. Enter a clear name, such as AssetSonar Offboarding Actions.
5. Select a single-tenant setup for your organization.
6. Complete the registration.

After the app is created, copy the following values from the app overview page:

• Application (Client) ID
• Directory (Tenant) ID

You will enter these values in AssetSonar when connecting the integration.

4. Create a client secret

Next, create a client secret for the app registration.

To create the client secret:

1. Open the app registration you created.
2. Go to Certificates & secrets.
3. Open Client secrets.
4. Click New client secret.
5. Enter a description and select an expiry period.
6. Click Add.
7. Copy the Client Secret Value and store it securely.

Warning: Copy the Client Secret Value, not the Secret ID. Microsoft may not show the secret value again after you leave the page.

5. Add Microsoft Graph application permissions

Add the required Microsoft Graph application permissions so AssetSonar can run Microsoft Entra and Microsoft 365 offboarding actions.

To add permissions:

1. Open the app registration.
2. Go to API permissions.
3. Click Add a permission.
4. Select Microsoft Graph.
5. Select Application permissions.
6. Add the required permissions as mentioned below.
7. Click Add permissions.
8. Click Grant admin consent for your organization.

Add the following Microsoft Graph application permissions:

Permission	Used for
User.RevokeSessions.All	Sign-in session revocation
DelegatedPermissionGrant.ReadWrite.All	OAuth permission grant removal
User.Read.All	User lookup
UserAuthenticationMethod.ReadWrite.All	MFA method removal
Sites.ReadWrite.All	OneDrive access handoff
MailboxSettings.ReadWrite	Outlook auto-replies and inbox forwarding rules
Calendars.ReadWrite	Calendar access sharing

Warning: UserAuthenticationMethod.ReadWrite.All is a sensitive Microsoft Graph permission. Make sure it is approved by an administrator with the required privileges in your tenant.

6. Connect Microsoft Entra offboarding actions in AssetSonar

After setting up the app registration, client secret, and Microsoft Graph permissions, connect the integration in AssetSonar.

To connect the integration:

1. Go to Settings → Integrations → User Provisioning & SSO.
2. Locate Microsoft Entra — Offboarding Actions.
3. Select Enabled.
4. Click Configure.
5. In the Configure Microsoft Entra Offboarding Integration popup, enter the following details:
   • Directory (Tenant) ID
   • Application (Client) ID
   • Client Secret Value
6. Select the relevant Azure cloud environment. For most users, this is Azure Public (Default).
7. Click Connect.
8. Click Update to save the integration settings.

Use the Directory (Tenant) ID, Application (Client) ID, and Client Secret Value from the Microsoft Entra app registration.

7. Validate the connection

When you save the integration, AssetSonar validates the credentials and required access. If validation succeeds, the integration is connected.

If validation fails, review the error message and check that:

• The Directory (Tenant) ID is correct.
• The Application (Client) ID is correct.
• The Client Secret Value was copied correctly.
• The required Microsoft Graph application permissions were added.
• Admin consent was granted for the organization.
• The selected Azure Cloud Environment matches your tenant environment.

8. Run Microsoft Entra offboarding actions from a member record

Once the integration is connected, you can run Microsoft Entra offboarding actions from the relevant member record.

To run an action:

1. Go to Members & Access → Members.
2. Open the member being offboarded.
3. Click More.
4. Select the relevant Microsoft Entra offboarding action.
5. Enter any required information.
6. Confirm the action.

AssetSonar uses the member’s primary email address to identify the matching Microsoft Entra user.

Warning: Make sure the member’s email address in AssetSonar matches their Microsoft Entra user principal name or email address. If the member does not have a primary email address, AssetSonar cannot run Microsoft Entra actions for that member.

9. Enter required inputs for handoff actions

Some Microsoft Entra offboarding actions can run directly from the member record, while others require additional information before they can run.

For example:

• Grant OneDrive Access requires a recipient email address.
• Set Email Auto-Reply may require internal and external reply messages, a forwarding option, or a forwarding email.
• Share Calendar Access requires the email address of the user receiving calendar access.

Enter the required details in the action popup before confirming the action.

For data handoff actions, the recipient is usually the employee’s manager, replacement, or a shared team inbox.

Note: Grant OneDrive Access grants the recipient access to the departing user’s OneDrive. It does not automatically transfer file ownership or move files into the recipient’s OneDrive.

10. Run Microsoft Entra actions in a security-first order

When running multiple Microsoft Entra actions during offboarding, use the security-first order below:

1. Revoke Sign-In Sessions
2. Revoke OAuth Permission Grants
3. Remove MFA Authentication Methods
4. Set Email Auto-Reply
5. Share Calendar Access
6. Grant OneDrive Access

The first three actions help close active access paths. Run them before handoff actions such as auto-replies, calendar sharing, and OneDrive access.

Note: Revoke Sign-In Sessions invalidates refresh tokens and browser session cookies. Short-lived access tokens that were already issued may remain valid until they expire according to your tenant’s token lifetime policy.

11. Review integration actions history

AssetSonar records Microsoft Entra offboarding action history on the member detail page.

Use Integration Actions history to review:

• Which action was run
• When the action was run
• Who initiated the action
• Whether the action succeeded or failed
• Any relevant status or error details

This gives IT teams an audit trail for access revocation and handoff actions completed during employee offboarding.

12. Use Microsoft Entra actions in offboarding workflows

Microsoft Entra offboarding actions can also be used in AssetSonar offboarding and automation workflows. This allows IT teams to combine Microsoft Entra actions with related offboarding tasks such as hardware retrieval, software license reclamation, approvals, and handoffs.

For example, an offboarding workflow can include security actions such as revoking sign-in sessions and removing app access, followed by handoff actions such as granting OneDrive access or sharing calendar access.

To build structured employee exit workflows, read our guide on Creating Offboarding Workflows. To learn how to automate broader IT workflows, see Automate IT Workflows.

Ready to secure Microsoft Entra offboarding?

With Microsoft Entra offboarding actions in AssetSonar, IT teams can run key account security and handoff actions from one place. You can revoke sign-in sessions, remove app access, remove MFA methods, grant OneDrive access, set email continuity, and share calendar access as part of a structured offboarding process.

Need help setting up Microsoft Entra offboarding actions? Reach out to us at support@ezo.io — we’re happy to assist.