How to disable Microsoft 365 users

Blocking sign-in for a Microsoft 365 user is a critical security measure used to immediately prevent access to organizational data without deleting the account or its associated data. Unlike account deletion, blocking sign-in for Microsoft 365 users keeps their email, files, and license assignments intact.

This article details how to block sign-in for Microsoft 365 users using the Microsoft 365 admin center and Microsoft Graph PowerShell, and how to disable multiple Microsoft 365 users in a single click using ManageEngine M365 Manager Plus, a dedicated Microsoft 365 administration tool.

Method 1: Block sign in for Microsoft 365 users with Microsoft 365 admin center

Prerequisites

You must have the User Administrator or Global Administrator role for the account you use to sign in to the Microsoft 365 admin center.

Steps

1. Log in to the Microsoft 365 admin center.
2. Navigate to Users > Active users.
3. Select the user you wish to disable.
4. Select Sign out of all sessions and then Block sign-in if you wish to disable the user as soon as possible.
5. Enable the Block this user from signing in checkbox and click Save changes.
6. The user's status will now display a red "Blocked" tag.

A limitation to consider

You will have to perform the same set of steps for Microsoft 365 users you disable in the Microsoft 365 admin center. To disable multiple Microsoft 365 users, you will have to resort to complex Microsoft Graph PowerShell scripts, or you can try out M365 Manager Plus to block sign ins for Microsoft 365 users effortlessly, which would only take a few clicks with its user-friendly interface.

Method 2: How to block Microsoft 365 user accounts with Microsoft Graph PowerShell (Update-MgUser)

Prerequisites

Before using Microsoft Graph PowerShell, please verify that:

1. The User Administrator or Global Administrator role is applied to the account you use to sign in to Microsoft Graph PowerShell.
2. You are connected to the Microsoft Graph PowerShell module.
   1. To check if the Microsoft Graph PowerShell module is installed, use this script:
      Copy

      Get-Module Microsoft.Graph -ListAvailable

      If it does not return a value, you will have to install the module.

   2. To install the Microsoft Graph PowerShell module, execute this script:
      Copy

      Install-Module Microsoft.Graph -Scope CurrentUser

   3. To connect to Microsoft Graph, run this script:
      Copy

      Connect-MgGraph -Scopes "User.ReadWrite.All"

Run Update-MgUser to disable Microsoft 365 user accounts

The Update-MgUser cmdlet in Microsoft Graph PowerShell is used to modify the properties of a Microsoft 365 user, ranging from their display name, job title, department, and in this case, account status.

The Update-MgUser cmdlet is used here with the AccountEnabled parameter to block sign in for one Microsoft 365 user account.

Update-MgUser -UserId user@domain.com -AccountEnabled:$false

Update-MgUser -UserId user@domain.com -AccountEnabled:$true

Disable multiple Microsoft 365 users in a group with Microsoft Graph PowerShell (Update-MgUser)

Scenario: A Microsoft 365 user administrator is tasked with blocking an entire department named "Shadow" for certain legal purposes.

Use the following Microsoft Graph PowerShell script to block sign in for multiple Microsoft 365 users in the group in a single run.

$users = Get-MgUser -Filter "department eq 'Shadow'" -All

foreach ($user in $users) {
    Update-MgUser -UserId $user.Id -AccountEnabled:$false
}

Method 3: Disable Microsoft 365 users with M365 Manager Plus

Steps

1. Log in to M365 Manager Plus, navigate to the Management tab > Azure Active Directory > User Management and select Block Users.
2. Select the Microsoft 365 Tenant, enter the display names of the Microsoft 365 users you want to block sign-in for and click Find, or upload a CSV with the display names using CSV Import and click Import CSV.
3. After finalizing the list of Microsoft 365 users you want to disable, click Apply.

Streamline Entra ID user life cycle management

M365 Manager Plus provides a unified command center for managing the entire life cycle of your Entra ID users, especially during critical offboarding phases. Gain instant visibility into sign-in statuses, account risks, and orphaned objects across your tenant. View, manage, and track identity objects across your Microsoft 365 tenant from a single console without switching between multiple admin portals.

Important tips

Frequently asked questions