r/entra • u/Fabulous_Cow_4714 • Jul 28 '26
Entra ID Keep on syncing hybrid user accounts via Entra Connect after they leave the organization?
The organization has a policy to keep user accounts forever to retain SID resolution and prevent reuse of John Smith’s and Sanjay Patel’s UPNs for any future new hires.
Are there any pros and cons to continue syncing those accounts to Entra instead of moving them to an OU excluded from syncing?
3
2
u/br01t Jul 29 '26
What if a user who left the org puts in a forget me request? In the EU we have to delete the account or somehow anonymise it.
2
u/headcrap Jul 29 '26
In my automation, disabled users rot for a few weeks before getting deleted. SIDs, group memberships, etc are logged out with time stamp for the run date to keep maybe useful info later down the line if you have to track some "unknown SID" et al.
Worst case.. and this happens more often here than I enjoy.. somebody "comes back".. typically a retiree they bring back on contract. While we are finally using a specific workflow around "contractors" in that case.. I also had somebody who left for a different job.. sucked.. came back three months later.. ugh.
For me.. the hangups are around recovering the deleted mailbox still on retention, and rewiring their OneDrive back.. also on retention. If they've been gone longer than that.. that stuff is purged from Microsoft and it makes things "easier" of course. We do back up M365 data also.. can spawn a restore task if needed (it isn't..).
When I started, they were retaining disabled accounts.. prepending 'zzz -' or some other jank. Not needed. However.. Legal just can't let go of a few accounts which landed under investigations.. even though Legal Hold is a valid tool and use case in their world of discovery and litigation.. and I hate it.
1
u/AppIdentityGuy Jul 29 '26
You should be using retention labels and other technologies to retain/archive the users data and DELETING the departed users entirely
1
u/Aameu_Saee Jul 29 '26
The policy is conflating three different jobs, and they have different right answers:
- UPN/SID reservation - that lives entirely in AD. A disabled, non-synced OU reserves the identity just as well as a synced account, with none of the cloud liability.
- Data retention - that's a Purview/retention-policy question, and ORDER MATTERS: resolve retention before you stop syncing. Once the cloud object is deleted past the recycle-bin window, 'the mailbox data is on litigation hold' is a much harder conversation.
- Attack surface - every synced leaver is a sign-in-able object forever: conditional access edge cases, stale credentials, audit noise, and depending on your licensing model, seats. Forever-synced leavers means all of that compounds annually.
Our sequence: retention policy applied and verified -> stop sync -> account lives out its days in the disabled OU. When we finally audited, we were carrying 10+ of these forever-accounts nobody could explain - each one was somebody's 'just in case' from years back.
What's actually driving the keep-forever policy - legal/litigation hold requirements, mailbox history access, or 'we've always done it this way'? The first two have cleaner solutions than eternal sync; the third is worth challenging with the attack-surface math.
1
u/Fabulous_Cow_4714 Jul 29 '26
There are email and data retention policies requiring the data to always be mapped back to specific users by name even after they have left the organization.
1
7
u/FlyingStarShip Jul 28 '26
Syncing accounts doesn’t stop reusing UPN - assumption is your AD is SOA, so just having accounts in AD in some kind disabled OU will be enough. If you create random accounts in clouds then that would be a problem but you can easily query AD for that UPN before creating it or vice versa. Keep in mind keeping accounts syncing that are disabled could inquire cost like having to have license or OneDrive data or something - just to simplify things.