> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/administration/off-board-users.md).

# Off-board Users

{% hint style="warning" %}
Only complete the steps in part one if you have the ATO (Account Takeover) add-on. If you don't have this add-on, skip to part two.
{% endhint %}

***

### Part One: Disable Email Redaction

Organizations occasionally need to retrieve copies of email after an employee leaves a company. To support these situations, employee off-boarding **must** **begin with** disabling email redaction and allowing messages to be placed back in the mailbox.

**Why?**

When Email Redaction is enabled for an account, the original copies of sensitive messages are stored in Material’s infrastructure, not the user's mailbox. Anytime the user or an admin needs to temporarily access redacted messages, they can be restored to the mailbox either via the end user retrieval flow or Admin Force Unlock. When permanent retrieval is needed, admins can utilize the same Force Unlock feature, or simply disable Sensitive Email Redaction for a given user.

{% hint style="danger" %}
**Follow the right workflow**

If an account has already been disabled in Microsoft 365 or Google Workspace, Material can **no longer** place originals back in the mailbox.

**Before** **you disable** **an account in Microsoft or Google:**

* Disable Email Redaction to allow messages to return to the mailbox
* After confirming that all messages have been restored, turn off any other remediations, including Mail Syncing
* Disable licensing to fully disconnect the account
  {% endhint %}

#### Force Unlock Redacted Messages & Add Delegates

1. From the [Explorer](/getting-started/fundamentals/explore.md), select the account to unlock messages for.
2. From the bottom toolbar, click **Force Unlock Messages.**

<figure><img src="/files/Qykh47sDK66gqVdcdHx1" alt=""><figcaption><p>Explorer > Accounts</p></figcaption></figure>

Alternatively, open the **account details page,** click **All Actions (cmd+k),** then click **Force Unlock Messages:**

<figure><img src="/files/YQWuOEahfCexdWajE354" alt="" width="375"><figcaption></figcaption></figure>

1. Search for the messages you want to unlock (include all parameters because you will bulk unlock).
2. Click **Force Unlock Messages**.
3. Select a 1 year **Re-lock Grace Period**.
4. Check the box to notify yourself that all messages were unlocked.
5. Click **Yes, unlock messages**:

<figure><img src="/files/LQi6GAsno2g9Xv2wDijd" alt="" width="375"><figcaption></figcaption></figure>

{% hint style="warning" %}
Unlocking a large number of messages can take many hours to days.
{% endhint %}

8\. Optionally, assign delegates to complete MFA challenges on behalf of this user to access redacted content:

* Return to the Accounts page and re-select the account. From the bottom toolbar, click **Edit Delegates:**&#x20;

  <figure><img src="/files/HqQyODVwzk2NMKGIrhox" alt=""><figcaption></figcaption></figure>
* In the prompt, choose at least one existing account in Material. This will give them permission to retrieve messages in the account holder's mailbox after verifying their identity. Delegates added here only affect retrieval of messages via Material. They do not affect delegate relationships in Microsoft 365 or Google Workspace.

Once you have confirmed all sensitive messages have been restored to the user's mailbox, move on to **Part Two**.

### Part Two: Turn Off Remediations and Disable Licenses

9. Return to the Explorer, then open the account details.
10. Click any **On** next to any remediation to open the Remediation enablement settings:&#x20;

    <figure><img src="/files/c7t4tQO3ibOvtKwfs5El" alt="" width="375"><figcaption></figcaption></figure>
11. Scroll down to **Remediations**, then select **Set custom** ...
12. Toggle the remediations **Off** for each type then click **Save:**

<figure><img src="/files/fHbxPghx0DkOmccG0mVR" alt="" width="188"><figcaption></figcaption></figure>

13. Toggle the remediation to **Off**, then click **Save.**
14. Return to the account detail view, then click **Settings**.
15. Under Licenses:
    1. Select **Set custom Material** **Essentials and Advanced,** then select **None.**
    2. Toggle Account Takeover Resilience to **Off** (if you have this add-on).

       <figure><img src="/files/SYiir3e5ep3CcqBokVVK" alt="" width="375"><figcaption></figcaption></figure>

{% hint style="danger" %}
**If you have Account Takeover Resilience (ATOR):**

After you toggle ATOR off, you must ensure that you rehydrate messages into your inboxes **before** disconnecting the mailbox from Material. If you don't do this, it can result in data loss.

If you have any questions, please reach our to our support team **before** you take action.
{% endhint %}

***

## Automate your off-boarding flow

To make things simpler, you can designate a group just for off-boarded accounts and we'll automatically unlock messages when an account is added to the group.

1. Disable all the remediations for that group via Settings Overrides.
   1. If you have Email Redaction enabled, do not disable licensing, as that will result in messages not being restored to the off-boarded account.
2. Add any account to that group; the designated settings will be applied automatically.

<figure><img src="/files/Xx8auFcw4LQo2B4AAPqA" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
If you choose to off-board this way:

* You won't be able to track when messages are unlocked
* You won't need to assign delegates

If you need both of the above, follow [Part One](#part-one-disable-email-redaction) and [Two](#part-two-turn-off-remediations-and-disable-licenses) of this guide instead.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/administration/off-board-users.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.