Off-board Users

Only complete the steps in part one if you have the ATO (Account Takeover) add-on. If you don't have this add-on, skip to part two.

---

Part One: Disable Email Redaction

Organizations occasionally need to retrieve copies of email after an employee leaves a company. To support these situations, employee off-boarding must begin with disabling email redaction and allowing messages to be placed back in the mailbox.

Why?

When Email Redaction is enabled for an account, the original copies of sensitive messages are stored in Material’s infrastructure, not the user's mailbox. Anytime the user or an admin needs to temporarily access redacted messages, they can be restored to the mailbox either via the end user retrieval flow or Admin Force Unlock. When permanent retrieval is needed, admins can utilize the same Force Unlock feature, or simply disable Sensitive Email Redaction for a given user.

Follow the right workflow

If an account has already been disabled in Microsoft 365 or Google Workspace, Material can no longer place originals back in the mailbox.

Before you disable an account in Microsoft or Google:

• Disable Email Redaction to allow messages to return to the mailbox
• After confirming that all messages have been restored, turn off any other remediations, including Mail Syncing
• Disable licensing to fully disconnect the account

Force Unlock Redacted Messages & Add Delegates

1. From the Explorer, select the account to unlock messages for.
2. From the bottom toolbar, click Force Unlock Messages.

Explorer > Accounts

Alternatively, open the account details page, click All Actions (cmd+k), then click Force Unlock Messages:

1. Search for the messages you want to unlock (include all parameters because you will bulk unlock).
2. Click Force Unlock Messages.
3. Select a 1 year Re-lock Grace Period.
4. Check the box to notify yourself that all messages were unlocked.
5. Click Yes, unlock messages:

Unlocking a large number of messages can take many hours to days.

8. Optionally, assign delegates to complete MFA challenges on behalf of this user to access redacted content:

• Return to the Accounts page and re-select the account. From the bottom toolbar, click Edit Delegates:

  
• In the prompt, choose at least one existing account in Material. This will give them permission to retrieve messages in the account holder's mailbox after verifying their identity. Delegates added here only affect retrieval of messages via Material. They do not affect delegate relationships in Microsoft 365 or Google Workspace.

Once you have confirmed all sensitive messages have been restored to the user's mailbox, move on to Part Two.

Part Two: Turn Off Remediations and Disable Licenses

1. Return to the Explorer, then open the account details.
2. Click any On next to any remediation to open the Remediation enablement settings:

   
3. Scroll down to Remediations, then select Set custom ...
4. Toggle the remediations Off for each type then click Save:

1. Toggle the remediation to Off, then click Save.
2. Return to the account detail view, then click Settings.
3. Under Licenses:

   1. Select Set custom Material Essentials and Advanced, then select None.
   2. Toggle Account Takeover Resilience to Off (if you have this add-on).

      

If you have Account Takeover Resilience (ATOR):

After you toggle ATOR off, you must ensure that you rehydrate messages into your inboxes before disconnecting the mailbox from Material. If you don't do this, it can result in data loss.

If you have any questions, please reach our to our support team before you take action.

---

Automate your off-boarding flow

To make things simpler, you can designate a group just for off-boarded accounts and we'll automatically unlock messages when an account is added to the group.

1. Disable all the remediations for that group via Settings Overrides.

   1. If you have Email Redaction enabled, do not disable licensing, as that will result in messages not being restored to the off-boarded account.
2. Add any account to that group; the designated settings will be applied automatically.

If you choose to off-board this way:

• You won't be able to track when messages are unlocked
• You won't need to assign delegates

If you need both of the above, follow Part One and Two of this guide instead.