> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/administration/off-board-users.md).
# Off-board Users
When someone leaves your organization, off-board them in Material **before** you disable their account in Microsoft 365 or Google Workspace. Once an account is disabled with your provider, Material can no longer return redacted messages to the mailbox.
{% hint style="danger" %}
**Follow this order**
1. Turn off Email Redaction and wait for all redacted messages to return to the mailbox ([Part One](#part-one-disable-email-redaction)).
2. Turn off syncing and remediations, then remove the license ([Part Two](#part-two-turn-off-remediations-and-disable-licenses)).
3. Disable the account in Microsoft 365 or Google Workspace.
Reversing the order can leave messages locked with no way to recover them.
{% endhint %}
***
### Part One: Disable Email Redaction
When Email Redaction is enabled for an account, the original copies of sensitive messages are stored in Material’s infrastructure, not the user's mailbox. Anytime the user or an admin needs to temporarily access redacted messages, they can be restored to the mailbox either via the end user retrieval flow or Admin Force Unlock. When permanent retrieval is needed, admins can utilize the same Force Unlock feature, or simply disable Sensitive Email Redaction for a given user.
Only complete this part if Email Redaction is on for the account (part of the ATO Resilience add-on). If it isn't, skip to [Part Two](#part-two-turn-off-remediations-and-disable-licenses).
When Email Redaction is on, the original copies of sensitive messages are stored in Material’s infrastructure, not the user's mailbox. Turning Email Redaction off for the account returns those messages to the mailbox permanently.
To turn off Email Redaction for an account:
1. From the left navigation, click **Explorer**, then click **Accounts**.
2. Check the box next to the account, then from the bottom toolbar click **Edit Settings**.
3. Under **Remediations**, select **Override Email Redaction**, then toggle it **Off**.
4. Click **Save**.
{% hint style="info" %}
If you use Microsoft In-Place Archive and see **Restore Messages in Microsoft In-Place Archive** under **Remediations**, turn it on **before** you turn off Email Redaction. It returns archived messages to the **Retrieved Items** folder.
{% endhint %}
{% hint style="warning" %}
Returning messages can take weeks or months for large mailboxes. Wait until all messages are back in the mailbox before you move on to Part Two. If you need access sooner, force unlock the messages or add a delegate.
{% endhint %}
#### Get access before all messages return
**Force unlock messages**
1. From the left navigation, click **Explorer**, then click **Accounts**.
2. Click the row for the account to open it.
3. Click **All Actions** (or Cmd+K), then select **Force Unlock Messages**:
4. Under **Request details**, set the **Date range** to cover all the messages you need.
5. Set the **Relock grace period**. For off-boarding, choose a long period, such as 1 year.
6. Optionally, turn on **Completion notification** to get an email once all the messages are unlocked.
7. Click **Submit request**, review the details, then click **Yes, unlock messages**.
Unlocking a large number of messages can take many hours to days. For more detail, see [Unlock Messages for End Users](/email-protections/email-identity-protection/unlock-messages-for-end-users.md#method-2-force-unlock-messages).
**Add delegates**
Delegates can retrieve messages from this mailbox after verifying their own identity.
1. From the left navigation, click **Explorer**, then click **Accounts**.
2. Check the box next to the account, then from the bottom toolbar click **Edit Delegates**:
* Return to the Accounts page and re-select the account. From the bottom toolbar, click **Edit Delegates:**
* In the prompt, choose at least one existing account in Material. This will give them permission to retrieve messages in the account holder's mailbox after verifying their identity. Delegates added here only affect retrieval of messages via Material. They do not affect delegate relationships in Microsoft 365 or Google Workspace.
3. Add at least one existing account, then click **Save**.
Delegates added here only affect retrieving messages through Material. They don't change delegate relationships in Microsoft 365 or Google Workspace.
***
### Part Two: Turn Off Remediations and Disable Licenses
9. Return to the Explorer, then open the account details.
10. Click any **On** next to any remediation to open the Remediation enablement settings:
11. Scroll down to **Remediations**, then select **Set custom** ...
12. Toggle the remediations **Off** for each type then click **Save:**
Once all redacted messages are back in the mailbox (or if the account never had Email Redaction), turn off the rest of Material's protections and remove the license:
1. From the left navigation, click **Explorer**, then click **Accounts**.
2. Check the box next to the account, then from the bottom toolbar click **Edit Settings**.
3. Under **Syncing**, select **Override Email Sync**, then toggle it **Off**.
4. Under **Remediations**, for each remediation that's on, such as **Email Threat Remediation**, **Email Bomb Protection**, **Email Identity Protection**, and **OAuth App Remediation**, select **Override**, then toggle it **Off**.
5. Under **Licenses**, select **Override Material Essentials and Advanced**, then select **None**.
6. If the account has ATO Resilience, select **Override ATO Resilience**, then toggle it **Off**.
7. Click **Save**.
You can now disable the account in Microsoft 365 or Google Workspace.
***
## Automate your off-boarding flow
To off-board accounts without editing each one, set up a group for off-boarded accounts. When you add an account to the group, the group's settings apply automatically, including returning redacted messages to the mailbox.
1. From the left navigation, click **Explorer**, then click **Groups**.
2. Check the box next to your off-boarding group, then from the bottom toolbar click **Edit Group Settings**.
3. On the **Account Settings** tab, select **Override** for **Email Redaction** and each remediation, then toggle them **Off**.
4. Click **Save**.
5. Add accounts to that group in your directory. The group's settings apply automatically.
{% hint style="warning" %}
If the group turns off Email Redaction, don't set its license to **None**. Removing the license stops Material from returning messages to the off-boarded accounts.
{% endhint %}
{% hint style="info" %}
If you off-board this way:
* You won't be able to track when messages are unlocked
* You won't need to assign delegates
If you need either of those, follow [Part One](#part-one-disable-email-redaction) and [Part Two](#part-two-turn-off-remediations-and-disable-licenses) instead.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.material.security/administration/off-board-users.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.gif?alt=media&token=4787bbad-0d30-4d1c-993c-780137ee6c93)