Is their Active Directory account still active?

In order for an account to be active in Active Directory, it must have an Active logon status in the EID system AND one of the Affiliations or Entitlements mentioned here.

Can they still authenticate using Enterprise Authentication?

(Enterprise Authentication is backed by Austin Active Directory.)

abcxyzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz. Consider 2FA (Duo) as well………………………….

When does their account get removed from Active Directory?

An automated process removes Active Directory accounts based on conditions specified here.

Are they automatically removed from groups?

Users are not automatically removed from groups when they leave the University, even when their Active Directory account is disabled.

For the most part, groups in the Austin Active Directory are owned and managed by the Department that created them. Departments are responsible for maintaining the memberships of their groups, removing any members that are no longer necessary.
A user may need to be removed from a group if:

• They are no longer at the University

• They remain at the University but no longer fall under the intended scope of the group (for example, an employee who leaves your department and is still a current employee working for another department should be removed from groups that give them access to your department’s resources)

If they are still in an email distribution group, will they continue to get emails addressed to the group?

As long as they still have a M365 mailbox, they will receive emails addressed to any email distribution groups they are a member of.

How are group memberships managed?

If a group is located in a Departmental OU, its members can be managed by the Department’s Administrators using native tools (the Active Directory Users and Computers console, Active Directory Administrative Center, PowerShell). Others may have the necessary permissions to edit group memberships based on delegations and the group’s Managed By configuration.

If a group was created in the Department Group Tools OR its Managed By attribute is set along with the Manager can update membership list checkbox checked, its memberships can be managed in the Department Group Tools ( Documentation).

For email Distribution Groups, the Distribution List’s Managers can add/remove members using the Office 365 Management : My Services portal ( Documentation)
A department’s M365 Managers can also manage the membership of Distribution Lists using the Office 365 Management : My Users portal zzz ( Documentation)

Q

A

Q

A

Are their departmental accounts disabled or deleted when they leave the University?

At this time, no action is automatically taken on departmental accounts when the assignee leaves the University.
Department OU Owners are responsible for disabling or deleting departmental accounts when they are no longer needed.

Q

A

What about Service Accounts?

Service accounts can be assigned to more than one person at a time (although they can only be claimed by one person at a time).
When an assignee has left the University, a Department OU Owner should remove them from the list of assignees of their service accounts. This prevents them from having control over these service accounts if they ever do return to the University (a former employee in your department may later return as an employee in another department or a student).

How are departmental accounts managed?

Department OU Owners can manage their departmental accounts using the Department User Tools ( Documentation).