Réinitialiser MFA Accès après terminating an admin
Réinitialiser MFA Accès après terminating an admin
We have terminated an employee who was a Microsoft 365 admin and we need to immediately secure the tenant and reset MFA access.
Re: Réinitialiser MFA Accès après terminating an admin
Follow these steps to immediately secure the tenant and reset MFA access after terminating an admin:
1. **Reset the terminated admin's password and sign out of all sessions**
- In the Microsoft 365 admin center, go to **Users > Active users**
- Select the terminated admin's account and choose **Reset password**. Configure a strong random password and require password change on next sign-in if the account will be reassigned later
- After resetting the password, select the user again, go to the **Account** tab, and select **Sign out of all sessions**. This invalidates existing sessions within about an hour, or sooner if they navigate away or refresh
- For immediate sign-out via PowerShell, use:
```powershell
Revoke-MgUserSignInSession -UserId
```
2. **Revoke all active sessions using Microsoft Graph PowerShell** (strongly recommended for a compromised/terminated admin)
- Run PowerShell as administrator and set execution policy:
```powershell
Set-ExecutionPolicy RemoteSigned
```
- Install Graph modules if needed:
```powershell
Install-Module Microsoft.Graph.Authentication
Install-Module Microsoft.Graph.Users.Actions
```
- Connect with the required scope:
```powershell
Connect-MgGraph -Scopes User.RevokeSessions.All
```
- Revoke sessions for the terminated admin:
```powershell
Revoke-MgUserSignInSession -UserId
```
3. **Reset or remove MFA methods and app passwords for the terminated admin**
- Ensure the account's MFA methods are cleared or re-registered by another admin so the former employee cannot approve sign-ins
- If app passwords were used (for legacy clients), ensure they are deleted and not reused
4. **If the account is synced or federated, secure it on-premises**
- Reset the password in AD twice to mitigate pass-the-hash risk using `Set-ADAccountPassword`
- If federated, change the password in the on-premises identity system and notify the appropriate identity/security admin
5. **Enable and enforce MFA for remaining admins and critical accounts**
- Ensure all remaining Global Administrators have MFA enforced
- Use strong, phishing-resistant MFA where possible
6. **Review and tighten admin role assignments**
- Confirm the terminated admin's account is removed from all privileged roles
- Follow least-privilege guidance and keep Global Administrators minimal
- Ensure at least one other privileged account exists to reset admin passwords and MFA if needed
7. **Implement or verify self-service password reset (SSPR) and MFA registration policies**
- Enable SSPR and combined security information registration
- Ensure admins are registered with multiple MFA methods to avoid single-device dependency
8. **If tenant access is at risk**
- If no remaining Global Admin can sign in, follow Microsoft's tenant access recovery process via Microsoft 365 support with identity verification
1. **Reset the terminated admin's password and sign out of all sessions**
- In the Microsoft 365 admin center, go to **Users > Active users**
- Select the terminated admin's account and choose **Reset password**. Configure a strong random password and require password change on next sign-in if the account will be reassigned later
- After resetting the password, select the user again, go to the **Account** tab, and select **Sign out of all sessions**. This invalidates existing sessions within about an hour, or sooner if they navigate away or refresh
- For immediate sign-out via PowerShell, use:
```powershell
Revoke-MgUserSignInSession -UserId
```
2. **Revoke all active sessions using Microsoft Graph PowerShell** (strongly recommended for a compromised/terminated admin)
- Run PowerShell as administrator and set execution policy:
```powershell
Set-ExecutionPolicy RemoteSigned
```
- Install Graph modules if needed:
```powershell
Install-Module Microsoft.Graph.Authentication
Install-Module Microsoft.Graph.Users.Actions
```
- Connect with the required scope:
```powershell
Connect-MgGraph -Scopes User.RevokeSessions.All
```
- Revoke sessions for the terminated admin:
```powershell
Revoke-MgUserSignInSession -UserId
```
3. **Reset or remove MFA methods and app passwords for the terminated admin**
- Ensure the account's MFA methods are cleared or re-registered by another admin so the former employee cannot approve sign-ins
- If app passwords were used (for legacy clients), ensure they are deleted and not reused
4. **If the account is synced or federated, secure it on-premises**
- Reset the password in AD twice to mitigate pass-the-hash risk using `Set-ADAccountPassword`
- If federated, change the password in the on-premises identity system and notify the appropriate identity/security admin
5. **Enable and enforce MFA for remaining admins and critical accounts**
- Ensure all remaining Global Administrators have MFA enforced
- Use strong, phishing-resistant MFA where possible
6. **Review and tighten admin role assignments**
- Confirm the terminated admin's account is removed from all privileged roles
- Follow least-privilege guidance and keep Global Administrators minimal
- Ensure at least one other privileged account exists to reset admin passwords and MFA if needed
7. **Implement or verify self-service password reset (SSPR) and MFA registration policies**
- Enable SSPR and combined security information registration
- Ensure admins are registered with multiple MFA methods to avoid single-device dependency
8. **If tenant access is at risk**
- If no remaining Global Admin can sign in, follow Microsoft's tenant access recovery process via Microsoft 365 support with identity verification