Automating Microsoft 365 Employee Offboarding: Shared Mailboxes, Token Revocation & Intune License Reclaim

# ==============================================================================
# Enterprise M365 Employee Offboarding Script
# ==============================================================================
[CmdletBinding()]
param(
    [Parameter(Mandatory = $true)]
    [string]$UserPrincipalName,

    [Parameter(Mandatory = $true)]
    [string]$ManagerUPN
)

Write-Host ">>> [1/5] Disabling Account & Revoking Active Sessions..." -ForegroundColor Cyan
Update-MgUser -UserId $UserPrincipalName -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $UserPrincipalName | Out-Null
Write-Host "Tokens invalidated and account disabled." -ForegroundColor Green

Write-Host ">>> [2/5] Converting Mailbox to Shared & Assigning Delegation..." -ForegroundColor Cyan
Set-Mailbox -Identity $UserPrincipalName -Type Shared
Add-MailboxPermission -Identity $UserPrincipalName -User $ManagerUPN -AccessRights FullAccess -InheritanceType All -AutoMapping $true
Set-Mailbox -Identity $UserPrincipalName -HiddenFromAddressListsEnabled $true
Write-Host "Mailbox converted to Shared and delegated to $ManagerUPN." -ForegroundColor Green

Write-Host ">>> [3/5] Setting Out of Office Auto-Reply..." -ForegroundColor Cyan
Set-MailboxAutoReplyConfiguration -Identity $UserPrincipalName -AutoReplyState Enabled -InternalMessage "This employee has left the company. Please contact $ManagerUPN for assistance." -ExternalMessage "This contact is no longer with the organization. Please reach out to $ManagerUPN."

Write-Host ">>> [4/5] Initiating Intune Corporate Retire on Managed Devices..." -ForegroundColor Cyan
$devices = Get-MgUserManagedDevice -UserId $UserPrincipalName
foreach ($dev in $devices) {
    Write-Host "Retiring Intune Device: $($dev.DeviceName) ($($dev.Id))..." -ForegroundColor Yellow
    Invoke-MgRetireDeviceManagementManagedDevice -ManagedDeviceId $dev.Id
}

Write-Host ">>> [5/5] Reclaiming M365 & Intune Licenses (Retaining Data in Shared Mailbox)..." -ForegroundColor Cyan
# Shared Mailboxes without In-Place Archive only require a license if >50GB
$assignedLicenses = (Get-MgUser -UserId $UserPrincipalName -Property AssignedLicenses).AssignedLicenses
$removeSkuIds = $assignedLicenses.SkuId
if ($removeSkuIds) {
    Set-MgUserLicense -UserId $UserPrincipalName -AddLicenses @() -RemoveLicenses $removeSkuIds | Out-Null
    Write-Host "Reclaimed $($removeSkuIds.Count) licenses." -ForegroundColor Green
}
Write-Host ">>> OFFBOARDING COMPLETED FOR $UserPrincipalName" -ForegroundColor Green