Starters and leavers

Cloud > Starters and leavers runs the two jobs every MSP does week in, week out. Each run is a list of ordinary changes, so every step is in the change log with its before and after, and the whole run can be undone.

The list shows every run with the Person, What (starter or leaver), Customer, Status, Steps and When. You can also start a leaver from a user's Actions menu (Leaver...), several leavers from the users list's bulk More menu (Start leavers...), and either from Search (Ctrl K or Cmd K). Filter the list by what it was, customer, status and who started it. To make many starters from a spreadsheet, see Bulk, scheduled and time-limited changes.

Running a leaver#

1. Press Leaver.
2. Under Who is leaving, choose the Tenant, then the Person.
3. Review the Steps. They are listed in the order they run, and steps that cannot be done for this person are left out (for example mailbox steps for someone without a mailbox).
4. Tick or untick steps. Steps that need details (the automatic reply text, where to forward, who gets access) ask for them when ticked.
5. Under When, choose Now or Later and pick a date and time (for example 17:30 on their last day).
6. Optionally Link a ticket. When the run finishes, an internal note on the ticket lists each step and its result.
7. Type the person's sign-in address to confirm, and press Start leaver. The button says how many steps will run.

The leaver steps#

Listed in the order they run. Steps that cannot be done for the person are left out, and the ones ticked to start with are the recommended set (a template can change them).

The backup steps are covered in Backup.

A dismissed leaver is locked out first: signing out and blocking come before everything else, and the run shows Waiting for the final backup only while the steps that lose data wait for it. Steps depend on each other: licences only come off once the groups are gone and the mailbox is shared, and delete waits for the shared mailbox. If a step fails, the ones that depend on it are held back rather than run, so you never lose a mailbox.

Note: Some steps cannot be undone afterwards (removed MFA methods, a new password). Groups, licences, forwarding, the mailbox, mailbox and calendar access and even a deleted account can be put back with undo.

Making a new starter#

1. Press New starter.
2. Under Where, choose the Tenant and the Template to start from (the most specific default is chosen for you).
3. Fill in The account: first name, surname, Display name, Sign-in address (with the domain chosen from the tenant's domains), job title, department, office, mobile, Manager and Usage location (two letters such as GB; Microsoft needs it for licences). More details holds company, office phone, address, employee ID, start date and employee type, which signature tools and HR systems read.
4. Under What they get, choose Licences (each shows its free seats from the last sync and, where the licence is billed through a licence source, its price a month), Groups (dynamic groups add people by their own rules, so they are not listed), Shared mailboxes (they get full access, and the mailbox appears in their Outlook) and Calendars they can see. Copy from a colleague picks the licences and groups of someone doing the same job, which you can then change. Extra email addresses adds aliases, typed in full or as a pattern: {first}@ makes their first name at their domain, and {last}, {initial} and {domain} work too.
5. Under Signing in, choose A password or A password and a Temporary Access Pass, and whether to Ask them to choose their own password when they first sign in.
6. Under When, choose Now or Later, optionally Link a ticket, and press Make the account.

A half-filled starter or leaver form is not lost by accident: leaving the page by a breadcrumb, a menu item or Back asks Discard your changes? with Keep editing and Discard changes, and the browser asks before a reload or closing the tab.

Tenvara checks the account before the run is made: the domain belongs to the tenant, the address is not in use, there is a usage location if licences are chosen, and no dynamic group is chosen.

What runs#

Each part is its own step: make the account, set the manager, assign licences, add to each group and team, give access to each shared mailbox and calendar (last, and tried again after 30 seconds because Exchange is slow to know a new account), and issue a Temporary Access Pass (8 hours, usable more than once) if chosen.

When no seat of a licence is free, the step fails with the reason and the account is still made: add a seat and run the step again.

The password#

The new password (and pass) is shown to you, and only you, on the run's page until you dismiss it, for 24 hours at most. Other people, administrators included, only see that credentials exist. It is never put in the ticket note, the change log or activity.

Warning: A starter whose groups include one that can hold administrator roles can only be run by an administrator.

Customers who sync their own Active Directory#

When the tenant syncs from on-premises Active Directory and hybrid Active Directory is set up, starters and leavers start there.

A hybrid starter#

The form says the account is Made in Active Directory on the customer's domain controller, and asks for:

• The Account name (the pre-Windows 2000 logon name, 20 characters at most) and the OU to make it in, picked from the domain controller's OUs.
• Active Directory groups to join as the account is made. Groups synced to Microsoft 365 can be chosen in Groups too: those marked Synced are joined in Active Directory, the rest in Microsoft 365.

The run makes the account in Active Directory with a password only that domain controller can read, asks Entra Connect to sync, and waits ("Waiting for Microsoft 365 to sync") until Microsoft 365 has the account. Then it carries on by itself: usage location and the other cloud details, the manager, licences, cloud groups, the pass, and mailbox and calendar access. Country and extra addresses are set in Active Directory, so a hybrid starter leaves them out.

Make a cloud-only account instead is there for an account that should live only in Microsoft 365, such as a service account. A synced tenant without hybrid Active Directory set up refuses a starter rather than leaving it half made, unless you choose a cloud-only account.

A hybrid leaver#

For a synced user the form says they are disabled in Active Directory first, and the steps in Microsoft 365 wait until it shows the block. The password is reset in Active Directory, the groups that come from Active Directory are left there (so undo can put everything back), and Move to the leavers OU in Active Directory runs last, after the mailbox, OneDrive and licence steps. Delete the account is not offered: the account belongs to Active Directory.

Warning: When Entra Connect does not sync the leavers OU, Microsoft 365 deletes the account at its next sync (it can be restored for 30 days). That is why the move comes last.

Undo works for hybrid runs too: a starter's account is removed from Active Directory, and a leaver is moved back, enabled and given their groups again.

Following a run#

Open a run from the list to see each step with its result and Microsoft's words for any failure. A failing step does not stop the run; it ends completed, partial, failed or cancelled.

• A run that waits for something (a final backup, or Active Directory and Entra Connect) says what it is waiting for.
• Cancelling stops a scheduled run at once, or a running one before its next step.
• Running it again runs the failed, held back and cancelled steps again. Steps already done are not repeated.
• Undoing it reverts every reversible step, newest first, and marks the run reverted when all of them went back. Undoing destructive steps needs an administrator.

A scheduled run for a tenant that is excluded or disconnected by then fails with the reason rather than being skipped silently. A scheduled run also acts as the person who set it going, so it only runs while they still may: if their account is turned off, or they no longer work with that customer or may change Microsoft 365, its steps are cancelled with the reason and nothing reaches the tenant.

The list opens on the runs that need something (scheduled, waiting, running, failed or done with problems), at any age, plus runs finished in the last 14 days. The Done view has every finished run.

Templates#

Settings > Microsoft 365, the Starters and leavers tab, holds templates, so starters get the usual licences and groups and leavers the usual steps without picking them each time. Press New template and choose:

• Whether it is for starters or leavers.
• What it applies to: every tenant, one customer's tenants, or one tenant.
• For starters: licences, groups, teams to join, shared mailboxes, usage location, domain, job title, department and how they sign in. For tenants that sync from Active Directory, the OU for new users and the Active Directory groups.
• For leavers: which steps are on, the automatic reply ({name} becomes the leaver's name), whether forwarding keeps a copy, whether mailbox access is added to Outlook, and the level of calendar access given.

A new run starts from the most specific default template: the tenant's own, then its customer's, then the one for every tenant. Without any, a leaver starts from the recommended steps above and a starter from nothing. Whoever starts a run can still change anything.