The original version of this article was written by Paul Cunningham and published on January 15, 2015. This version is revised to reflect the current environment within Microsoft 365.
When you delete a Microsoft 365 user account from the Microsoft 365 admin center, the account enters a soft-deleted state for 30 days. During this time, administrators can recover the account easily if the deletion was not intended. Azure AD restores the account fully except for license assignments. This includes, for example, memberships of Microsoft 365 Groups (and teams), Exchange attributes such as mailbox permissions and delegates, files including shares in OneDrive, etc.
Thirty Day Deleted Account Retention Limit
The 30-day limit for deleted account retention is set by Azure AD. A tenant cannot choose another value. However, if you want to permanently remove a deleted Microsoft 365 user you can use PowerShell. Reasons why you might want to do this include:
- Incorrect provisioning of a user account.
- Preventing a soft-match through Azure AD Connect when the UPN or primary smtp address is the same.
- A mailbox with active hold is to be set to inactive.
Removing Deleted Azure AD Accounts with PowerShell
To remove accounts, you need both the Azure Active Directory PowerShell and Microsoft Online Services modules installed on your computer.
Caution: do not proceed unless you are completely sure that you want to permanently remove the users.
First, connect to Azure Active Directory by running Connect-AzureAD and entering your admin credentials. Also connect to Microsoft Online Services by running the Connect-MSolService cmdlet:
|
1
2
|
Connect–AzureAD
Connect–MSOlService
|
After connecting, run the Get-MsOlUser cmdlet to return a list of deleted users together with their object identifier:
|
1
2
3
4
5
6
|
Get–MsolUser –ReturnDeletedUsers | Format–Table DisplayName, ObjectId
DisplayName ObjectId
—————– ————
Chris Bishop 1368fd78–c2b4–4e14–8e69–65dddc432451
John Beddie 8dfa381e–685a–4ba6–a12a–6a7b35df8199
|
After finding the required account in the set returned by Get-MsolUser, you can remove their user object permanently by running the Remove-AzureADMSDeletedDirectoryObject.
|
1
|
Remove–AzureADMSDeletedDirectoryObject –Id 1368fd78–c2b4–4e14–8e69–65dddc432451
|
Removal is immediate and the account is then irrecoverable.
To permanently remove deleted accounts from Azure AD before their deletion retention period expires, you can pipe the set of objects retrieved by Get-MsolUser to the Remove-AzureADMSDeletedDirectoryObject cmdlet:
Source Practical365
