how to delete from m365 azure an orphaned user ad account

Question

an active directory domain controller failed and was forcibly removed. A new user account created on the problem DC had been synchronized via AzureADSync to M365 Azure / Entra, and is now orphaned, as the new AD account had never replicated to other domain controllers. It was necessary to create a new AD account for the user, but of course it does not synch to Azure. How do I delete the orphaned account from azure? A relevant posting indicates that remove-mguser can do this - I found that it was blocked.

Answer 1

To delete an orphaned user account in Microsoft Entra (formerly Azure AD) that was created through directory synchronization, you can use the Microsoft Graph PowerShell module. Here are the steps you should follow:

1. Ensure you have the necessary modules installed: Make sure that the Microsoft Graph PowerShell module is installed.
2. Connect to Microsoft Graph: You need to connect to your Microsoft 365 tenant using the appropriate permissions. Use the following command:

      Connect-MgGraph -Scopes User.Read.All, User.ReadWrite.All
   

3. Identify the orphaned user: You can find the orphaned user by using the Get-MgUser cmdlet with a filter for the user's principal name or display name. For example:

      $user = Get-MgUser -Filter "userPrincipalName eq '******@contoso.com'"
   

4. Remove the orphaned user: Once you have identified the user, you can remove them using the Remove-MgUser cmdlet:

      Remove-MgUser -UserId $user.id
   

If you encounter any issues with permissions or if the command is blocked, ensure that you have the necessary permissions assigned to your account to delete users in Microsoft Entra.

---

References:

• Can't manage or remove objects that were synchronized through the Azure Active Directory Sync tool
• Object deletions aren't synchronized to Microsoft Entra ID when using the Microsoft Entra ID Connect
• Delete Microsoft 365 user accounts with PowerShell

Answer 2

Accepted - this is what I needed, solved my problem perfectly! It was the -scopes parameter of connect-mgGraph that I was missing.