Skip to main content
Re-enable Terminated Account brings back someone you offboarded with User Offboarding. It turns their sign-in back on, puts back the licences, groups and Active Directory OU recorded when they were offboarded, and, if you choose, makes their shared mailbox their own mailbox again. It needs Microsoft 365 connected with a GDAP role that can enable users, such as User Administrator, Exchange access to convert the mailbox, and the desktop agent for a client that syncs on-premises Active Directory.
Before the first run, untick Licensed users only and Active users only under User directory filters. Offboarded accounts are blocked and usually unlicensed, so the User list leaves them out until you do.

Re-enable Terminated Account in 49 seconds: what it asks, what it does and what you get.

What the form asks

What it does

  1. Creates a ticket in your PSA, if Ticketing is on.
  2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
  3. Re-enable Sign-in: turns sign-in back on for the account in the client’s Microsoft 365.
  4. Restore Licences, if the form says Yes. If a licence can’t be assigned, for example because no seat is free, the run carries on and the ticket gets a note.
  5. Re-add To Group, for each recorded group, if the form says Yes.
  6. Convert To Regular Mailbox: makes the mailbox a user mailbox again in the client’s Exchange Online, if the form says Yes.
For an AD-synced account on a client that syncs on-premises AD, Set On-Prem Account State runs instead of Re-enable Sign-in: the desktop agent enables the account in Active Directory, moves it back to its previous OU if the form says Yes, then starts a delta sync if it runs on the Microsoft Entra Connect server. The mailbox is still converted in Exchange Online. If the Active Directory change fails, the run stops there. With Log actions to the ticket on, the ticket also gets a note when the run starts, after Re-enable Sign-in, Restore Licences, Re-add To Group and Convert To Regular Mailbox, and when the run completes. It doesn’t set or send a password.

What it puts back

Each time User Offboarding runs, Core records the leaver’s licences, groups and AD OU. When you pick a user on the run page, it shows what was recorded and when, and the three restore questions start on Yes where there is something to put back. A record older than 90 days is flagged so you can check it still fits. An account offboarded outside Core, or before Core kept records, has nothing to restore. The run page says so; answer No to the three questions and the account is re-enabled on its own.

What it doesn’t undo

Put back the rest of what User Offboarding changed yourself:

Configure it

Go to Config and click Re-enable Terminated Account, under Lifecycle.

Configure Re-enable Terminated Account: every option, step by step (1:25).

Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see How configuration works.

Troubleshooting

With Active users only ticked under User directory filters, accounts whose sign-in is blocked are hidden; with Licensed users only ticked, so are accounts without a licence. Untick both on Base config, or for that client. Guests and anyone in an Entra role you’ve excluded stay hidden.
The account was offboarded outside Core, or before Core kept records, so there is nothing to restore. Answer No to the three restore questions and submit again; then put back licences and groups with License Management and Group Membership.
This ticket note means a licence from the record couldn’t be assigned, usually because no seat is free or the licence was retired. The rest of the run carried on. Assign a licence in the Microsoft 365 admin center or with License Management.
Re-enable Terminated Account works on a disabled account. Restore the deleted user in the Microsoft 365 admin center first, within 30 days of the deletion.
This ticket note means the desktop agent couldn’t enable the account in Active Directory, and nothing was changed. The note includes the error. Enable the account in Active Directory, or fix the cause and run it again.