Check the target before changing it
The workflow validates the user and current configuration before applying changes. This reduces the risk of acting on the wrong account or an unexpected identity state.
Public portfolio project · Identity lifecycle automation
Manage-UserLOA
A PowerShell module for repeatable leave-of-absence workflows across hybrid Active Directory and Microsoft 365, designed around validation, reversibility and operator-readable output.
Interactive walkthrough
One workflow, including the return path
The project treats leave as a temporary identity state rather than a one-way offboarding event.
Validate userinputs + current state
Secure identitydisable + move
Mailbox handlingOOO + delegation
leave workflow → recorded state → operational evidence
Ticket summarybefore + after
Stored original statereturn context
Restore userreturn from leave
Apply the temporary access state
The account can be disabled, moved to a configured organisational unit and hidden from address lists according to the operational process.
Preserve business continuity
Mailbox handling includes out-of-office configuration and optional manager delegation so legitimate business communication can continue.
Produce evidence for the operator
Before-and-after summaries make the result easier to review and transfer into service-management records without reconstructing the changes manually.
Keep the information needed for reversal
The original organisational-unit path and relevant state are retained so the workflow can support a predictable return rather than relying on memory.
Restore the user deliberately
The return workflow reverses the temporary settings and restores the account using the recorded context, with operator review still part of the process.
Design decisions
Automation shaped for operational safety
Reversibility is a first-class requirement
A leave workflow must support return. The module records the original state instead of treating account changes as disposable.
Output is part of the interface
Operators need evidence they can review and place in a ticket. Human-readable summaries are as important as the underlying commands.
Optional integrations remain controlled
External connector patterns are disabled by default so examples do not silently create new dependencies or unexpected actions.
Why this matters
Identity lifecycle work is repetitive but high-risk. A missed mailbox, group or account step can create security exposure or operational disruption. The project makes the process easier to review and repeat.
What the repository contains
- Leave and return workflow functions
- Hybrid AD and Exchange Online operations
- OU movement and GAL visibility handling
- Mailbox delegation and out-of-office configuration
- Sanitised examples and operational documentation