n8n Offboarding Workflow: Microsoft 365 + Entra ID + Graph

Offboard Microsoft 365 users faster with an n8n Microsoft Graph workflow

This n8n Offboarding Workflow performs a manual leaver process in Microsoft 365 using Microsoft Graph: it disables the user in Entra ID, revokes active sign-in sessions, optionally converts the mailbox to a shared mailbox via Azure Automation, removes Microsoft 365 licenses, retires Intune-managed devices, and emails a step-by-step audit report.

What this workflow does

1. Manual trigger: Start the workflow and provide the leaver’s UPN plus notification email details.
2. Resolve user in Microsoft Graph: Looks up the user and stops immediately if the UPN cannot be resolved.
3. Disable the Entra ID account: Disables the user account via Microsoft Graph.
4. Revoke sign-in sessions: Revokes the user’s active sign-in sessions using Microsoft Graph.
5. Optional mailbox conversion: Calls an Azure Automation webhook to run an Exchange Online PowerShell runbook that converts the mailbox to a shared mailbox.
6. Remove Microsoft 365 licenses: Removes all assigned licenses using Microsoft Graph.
7. Retire Intune devices (optional): Lists the user’s Intune-managed devices and sends a Microsoft Graph retire request for each device.
8. Email audit report: Builds a per-step outcome report and emails it using Microsoft Graph sendMail; marks execution as failed if any step reported an error.

Use cases

• Automate offboarding checklists for SaaS operators who need consistent, auditable leaver handling.
• Reduce admin time by consolidating Entra ID + Microsoft 365 offboarding actions into one n8n workflow.
• Ensure immediate access removal (session revocation) while coordinating mailbox and device handling.

Technical details

• Microsoft Graph via n8n Generic OAuth2 (client credentials) connection.
• Required app registration permissions: User.Read.All, User.ReadWrite.All, User.RevokeSessions.All, Organization.Read.All, Mail.Send, DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.PrivilegedOperations.All.
• Workflow nodes/logic: if, set, code, split out, sticky note, http request.