0

I have a bunch of accounts disabled in AD. These users left the organization. However we do not delete their accounts incase they come back.

This creates issues in 0365 people search. I would like to delete their UPSA User Profile so that they will not show up in any search.

I tried Remove-PnPUserProfile but I keep getting this error: "username@mydomain.com must be first be deleted from AAD before the user profile can be deleted"

Is there a way to delete the profile without deleting the AAD account? I can do this from the UI but I need to do it programmatically.

1

If you are syncing with your on-premises AD with Azure AD, you can create an OU on the on-prem AD Domain Controller named “EXITS”. Then move all the former employees to the “EXITS” OU. Then, configure your on-Prem AD ➡️ Azure AD sync to exclude that OU. On-premises, just ensure that all the accounts in the “EXITS” OU are disabled. Before doing so, I would also generate a new password for the account - don’t use a default password - so that if the account ever left the “EXITS” OU, the user would not have access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.