Skip to main content
< All Topics
Print

How to Block a User from Signing In to Microsoft 365 –

Posted
Updated
Bychris_fry

Blocking sign-in stops a user from accessing any Microsoft 365 service (Outlook, Teams, OneDrive, SharePoint) without deleting the account. Their mailbox, files and licenses stay intact, so the block can be reversed at any time.

Common reasons to block sign-in include an employee departure, a suspected compromised account, or a leave of absence.

Applies to: Microsoft 365 / Office 365, Microsoft Entra ID

Required role: Global Administrator or User Administrator

Time to complete: About 2 minutes

Procedure: Microsoft 365 admin center

  1. Sign in to the Microsoft 365 admin center at admin.microsoft.com.
  2. Go to Users > Active users.
  3. Click the name of the user to open their details pane.
  4. Select Block sign-in (in the details pane, or from the ⋯ menu next to the user’s name).
  5. Check Block this user from signing in.
  6. Click Save.

Result: The user can no longer start new sign-ins. Sessions already open can stay active for up to an hour unless you revoke them (next section).

Revoke active sessions (recommended)

Blocking sign-in does not immediately sign the user out of apps they already have open. For departures or compromised accounts, force them out right away:

  1. Sign in to the Microsoft Entra admin center at entra.microsoft.com.
  2. Go to Users > All users and select the user.
  3. Click Revoke sessions, then confirm.

Alternative: PowerShell (Microsoft Graph)

Useful for scripting or blocking several users at once. Run in PowerShell with the Microsoft Graph module installed:

Connect-MgGraph -Scopes "User.ReadWrite.All"
Update-MgUser -UserId user@yourdomain.com -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId user@yourdomain.com

The older MSOnline and AzureAD modules are retired; use Microsoft Graph PowerShell instead.

How to unblock a user

  1. In the Microsoft 365 admin center, go to Users > Active users and select the user.
  2. Select Unblock sign-in.
  3. Uncheck Block this user from signing in and click Save.

PowerShell equivalent: Update-MgUser -UserId user@yourdomain.com -AccountEnabled:$true

Notes and troubleshooting

  • Synced accounts: If the user is synced from on-premises Active Directory, disable the account in AD instead. A change made in the cloud may be overwritten at the next sync.
  • Licenses still apply: A blocked user still consumes a license. Remove it if the account is being retired.
  • Mailbox access: To give a manager access to a departed user’s email, grant mailbox delegation or convert the mailbox to a shared mailbox.
  • Option greyed out: Confirm you have the User Administrator or Global Administrator role.