Please confirm:
Problem Statement
CIPP currently provides a comprehensive user off-boarding process, but there is no equivalent way to reverse that process if a user returns, was off-boarded accidentally, or needs to be reactivated.
I would like an Undo Off-Boarding / Restore User option that uses the state of the user captured before the original off-boarding and restores everything that can reasonably be restored.
For example, if the off-boarding process performed the following actions:
- Converted the mailbox from a User Mailbox to a Shared Mailbox
- Removed the user's Microsoft 365 licenses
- Removed the user from Microsoft 365 / Entra groups
- Removed mailbox or calendar permissions
- Disabled OneDrive sharing
- Hid the user from the GAL
- Disabled the account or made other reversible account changes
The restore process would attempt to reverse those actions by:
- Converting the Shared Mailbox back to a User Mailbox
- Reassigning the same Microsoft 365 license(s) the user had before off-boarding, where licenses are available
- Restoring the user's previous group memberships
- Restoring mailbox and calendar permissions that were removed
- Restoring other reversible settings changed by the off-boarding process
- Re-enabling the account where applicable
I understand that some off-boarding actions are destructive or cannot be automatically reversed. For example, revoked sessions cannot be restored, removed MFA methods would need to be registered again, mobile device wipes cannot be undone, and deleted data cannot necessarily be recovered. Those items could simply be identified as non-reversible during the restore process.
Ideally, CIPP would store a snapshot of the user's relevant configuration when off-boarding begins. The administrator could then open the completed off-boarding job and select something such as Restore User / Undo Off-Boarding, review which settings are going to be restored, and execute the restoration.
This would be especially useful for returning employees, temporary departures, or accidental off-boardings, and would avoid having to manually reconstruct the user's licensing, memberships, permissions, and mailbox configuration from memory or audit logs.
Benefits for MSPs
This would significantly reduce manual work when an employee returns, an account is off-boarded by mistake, or a previously separated employee needs to be restored.
Today, an MSP may have to manually determine which licenses, groups, mailbox permissions, calendar permissions, mailbox type, and account settings the user previously had. Depending on how much time has passed, some of that information may be difficult to reconstruct accurately.
Having CIPP retain the pre-offboarding state and provide a guided restore process would make this much faster and more consistent across tenants. It would also reduce the chance of missing a group membership, permission, license, or other setting during reactivation.
This would turn what is currently a potentially time-consuming manual recovery process into a repeatable workflow that MSP technicians can perform consistently.
Value or Importance
This is particularly valuable because off-boarding is already an automated workflow in CIPP, but there is currently no corresponding recovery workflow.
Employee returns are fairly common, especially with seasonal employees, contractors, temporary departures, and employees who are rehired. Accidental or premature off-boardings can also occur.
The most important part of this feature would be preserving the user's configuration at the time of off-boarding. Without that snapshot, restoring the account later can require searching audit logs, documentation, group memberships, licensing history, and other systems to determine how the account was originally configured.
Even if some actions cannot be reversed, such as an issued mobile-device wipe, revoked sessions, or removed MFA registrations, restoring everything that can be restored would still provide substantial value. CIPP could clearly identify the non-reversible items and allow the administrator to handle those separately.
This would make the existing off-boarding feature more complete by providing a practical recovery path instead of making off-boarding essentially a one-way operation.
PowerShell Commands (Optional)
No response
Please confirm:
Problem Statement
CIPP currently provides a comprehensive user off-boarding process, but there is no equivalent way to reverse that process if a user returns, was off-boarded accidentally, or needs to be reactivated.
I would like an Undo Off-Boarding / Restore User option that uses the state of the user captured before the original off-boarding and restores everything that can reasonably be restored.
For example, if the off-boarding process performed the following actions:
The restore process would attempt to reverse those actions by:
I understand that some off-boarding actions are destructive or cannot be automatically reversed. For example, revoked sessions cannot be restored, removed MFA methods would need to be registered again, mobile device wipes cannot be undone, and deleted data cannot necessarily be recovered. Those items could simply be identified as non-reversible during the restore process.
Ideally, CIPP would store a snapshot of the user's relevant configuration when off-boarding begins. The administrator could then open the completed off-boarding job and select something such as Restore User / Undo Off-Boarding, review which settings are going to be restored, and execute the restoration.
This would be especially useful for returning employees, temporary departures, or accidental off-boardings, and would avoid having to manually reconstruct the user's licensing, memberships, permissions, and mailbox configuration from memory or audit logs.
Benefits for MSPs
This would significantly reduce manual work when an employee returns, an account is off-boarded by mistake, or a previously separated employee needs to be restored.
Today, an MSP may have to manually determine which licenses, groups, mailbox permissions, calendar permissions, mailbox type, and account settings the user previously had. Depending on how much time has passed, some of that information may be difficult to reconstruct accurately.
Having CIPP retain the pre-offboarding state and provide a guided restore process would make this much faster and more consistent across tenants. It would also reduce the chance of missing a group membership, permission, license, or other setting during reactivation.
This would turn what is currently a potentially time-consuming manual recovery process into a repeatable workflow that MSP technicians can perform consistently.
Value or Importance
This is particularly valuable because off-boarding is already an automated workflow in CIPP, but there is currently no corresponding recovery workflow.
Employee returns are fairly common, especially with seasonal employees, contractors, temporary departures, and employees who are rehired. Accidental or premature off-boardings can also occur.
The most important part of this feature would be preserving the user's configuration at the time of off-boarding. Without that snapshot, restoring the account later can require searching audit logs, documentation, group memberships, licensing history, and other systems to determine how the account was originally configured.
Even if some actions cannot be reversed, such as an issued mobile-device wipe, revoked sessions, or removed MFA registrations, restoring everything that can be restored would still provide substantial value. CIPP could clearly identify the non-reversible items and allow the administrator to handle those separately.
This would make the existing off-boarding feature more complete by providing a practical recovery path instead of making off-boarding essentially a one-way operation.
PowerShell Commands (Optional)
No response