The problem
Leave-of-absence changes span account access, mailbox delegation, directory visibility and out-of-office settings. A manual checklist can leave gaps, especially when someone returns.
What I built
A PowerShell module for the standard leave and return lifecycle in hybrid Active Directory and Microsoft 365 environments. LOA means leave of absence. Start-UserLOA handles leave; End-UserLOA handles return.
The workflow disables and restores the account, moves it into and out of a leave organisational unit (OU), and hides and restores it in the global address list (GAL). It grants and removes manager mailbox FullAccess and SendAs permissions and handles out-of-office (OOO) settings when appropriate. Before-and-after summaries support human review and ticket notes.
Decisions and trade-offs
- The original organisational unit is saved before the move and cleared only after a successful return move.
- Public commands support WhatIf and confirmation prompts with high confirmation impact.
- Optional SaaS connector patterns are disabled by default. Connector failures do not block the core AD and Exchange workflow.
- Standard reversal is not a perfect historical rollback. Existing permissions, directory hiding, out-of-office settings and SaaS state need operator judgement.
What I verified
The README records passing offline helper, metadata and mocked workflow tests with Pester on 27 June 2026. Live AD, Exchange Online and SaaS validation remains manual. I do not treat the offline tests as proof of a live deployment.
What I would do differently
Further reflections will be added after review. The documented limitation is that pre-existing state may need manual restoration.
Links
Read the repository for the workflow, test status and rollback limitations.