How can i lock device access from a terminated employee using Intune or AD?

Question

I am able to block the user or reset there password to kick them out of 365, however in all test cases we are still able to log in to the local device with a pin. I'm scratching my head on this one, any ideas? Wipeing the device seems like our best option at at this time.

Answer 1

Wipe will reset OS to factory setup, OOBE. Delete device account would prevent user to login to device and let Windows stay to login screen. I suggest to use Delete option, in that case user needs to figure out by his own how to boot to install media re-install Windows by his own to keep continue to use the computer.

Test out the Delete scenario carefully in your infrastructure, but it should behave as I discribed.

Answer 2

@Chris Sieferty, Thanks for posting in Q&A. To block one user to access all devices, you can consider disable the user account.

If you want to block the user to access one or some device, you can try the policy in the following link:

https://www.inthecloud247.com/restrict-which-users-can-logon-into-a-windows-10-device-with-microsoft-intune/

Note: None-Microsoft link, just for the reference.

Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.