Identity & SSO

PurpletGo + Microsoft 365 / Azure AD

Disable the account, revoke sign-in sessions, and strip M365 licenses - one action.

30-day free trial - no credit card required

What it does

What PurpletGo does in Microsoft 365 / Azure AD

Disable a departing employee's Microsoft 365 account, end their sessions, remove their groups and licenses, and see the license cost you reclaim.

Disables the account in Microsoft Entra ID.
Revokes all sign-in sessions.
Removes the user from their groups.
Removes assigned licenses, and reports the cost reclaimed if you set a per-seat cost.
Turns on an out-of-office reply on the mailbox that points colleagues to the manager's email on the offboarding (on by default, and can be turned off in the integration settings).
Suggests apps to revoke from the user's enterprise app assignments, and can import your directory on demand.
Runs when an admin or HR user revokes access for the offboarding, alongside the other systems selected for that person, and the result is recorded as revoked, failed, or needs manual action, with the reason.

What you need

An Azure app registration: Tenant ID, Client ID, and a client secret.
Application permissions with admin consent: User.ReadWrite.All, User.RevokeSessions.All, Directory.Read.All, GroupMember.ReadWrite.All, LicenseAssignment.ReadWrite.All, MailboxSettings.ReadWrite, and Organization.Read.All.

Plan

All plans

Compare plans

Setup

Set up Microsoft 365 / Azure AD in PurpletGo

1
In Azure, register an app, add the permissions above, grant admin consent, and create a client secret.
2
In PurpletGo, open Integrations, find Microsoft 365 / Azure AD, and click Connect.
3
Enter the Tenant ID, Client ID, and client secret, and confirm your password.
4
Optionally run Sync Now to import employees and set your license cost per seat.

Good to know

Each step runs independently, and the result shows which steps succeeded. The run counts as revoked only when the account is disabled and sessions are revoked, and every other step succeeded.
Revoking sessions needs User.RevokeSessions.All. Existing connections without it will show a failed result until the permission is added.
Microsoft Teams access ends because the account is disabled.
Dynamic or on-premises synced groups may need to be changed at their source.

Why this matters

Forgetting to strip a Microsoft 365 license after departure doesn't just leave a security gap - it means paying for a seat nobody's using until someone remembers to clean it up.

Microsoft 365 / Azure AD FAQ

Common questions about the Microsoft 365 / Azure AD integration

What does PurpletGo do in Microsoft 365 / Azure AD?

Disable a departing employee's Microsoft 365 account, end their sessions, remove their groups and licenses, and see the license cost you reclaim.

Why does revoking Microsoft 365 / Azure AD access matter when someone leaves?

Forgetting to strip a Microsoft 365 license after departure doesn't just leave a security gap - it means paying for a seat nobody's using until someone remembers to clean it up.

Which PurpletGo plan includes the Microsoft 365 / Azure AD integration?

All plans.

What do I need to connect Microsoft 365 / Azure AD to PurpletGo?

An Azure app registration: Tenant ID, Client ID, and a client secret. Application permissions with admin consent: User.ReadWrite.All, User.RevokeSessions.All, Directory.Read.All, GroupMember.ReadWrite.All, LicenseAssignment.ReadWrite.All, MailboxSettings.ReadWrite, and Organization.Read.All.

Google Workspace Okta JumpCloud OneLogin

Offboard with every system accounted for

Some integrations need the Team or Enterprise plan, shown above.

Start free trial