How to revoke user access in Microsoft Entra ID (previously Azure AD) using PowerShell cmdlets

Instances demanding an admin to terminate a user's access may arise from compromised accounts, employee terminations, or insider threats. Depending on the system's complexity, admins follow specific procedures to ensure access removal. Sometimes, there might be a delay between starting and completing access revocation.

In Microsoft Entra ID, as an administrator, open PowerShell, execute Connect-MgGraph, and perform the subsequent tasks:

1. Disable the user in Microsoft Entra ID

               $User = Get-MgUser -Search UserPrincipalName:'user@example.com' -ConsistencyLevel eventual
               Update-MgUser -UserId $User.Id -AccountEnabled:$false

    Copied

   Click to copy entire script

2. Revoke the user's Microsoft Entra ID refresh tokens.

               Revoke-MgUserSignInSession -UserId $User.Id

    Copied

   Click to copy entire script

3. Disable the user's devices.

               $Device = Get-MgUserRegisteredDevice -UserId $User.Id 
               Update-MgDevice -DeviceId $Device.Id -AccountEnabled:$false

    Copied

   Click to copy entire script

Streamline Entra ID management using M365 Manager Plus

M365 Manager Plus is an extensive Microsoft 365 tool used for reporting, managing, monitoring, auditing, and creating alerts for critical incidents. With M365 Manager Plus, you can use the following features to enhance your organizational workflow:

• Manage mailboxes, users, groups, sites, and contacts effortlessly in bulk.
• Gain a thorough understanding of your environment in Exchange Online, Azure Active Directory, SharePoint Online, OneDrive for Business, and other Microsoft 365 services with detailed reports.
• Keep tabs on even the most granular user activities in your Microsoft 365 environment.
• Monitor the health and performance of Microsoft 365 features and endpoints around the clock.
• Create custom roles with any combination of reporting, management, and auditing tasks and assign them to non-administrative users to reduce the workload of Microsoft 365 admins.