You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Clean up unmanaged Azure Active Directory accounts
18
18
19
-
Azure Active Directory (Azure AD) supports self-service sign-up for
20
-
email-verified users. Users can create Azure AD accounts if they can
21
-
verify email ownership. To learn more, see, [What is self-service
22
-
sign-up for Azure Active
23
-
Directory?](./directory-self-service-signup.md)
24
-
25
-
However, if a user creates an account, and the domain isn't verified in
26
-
an Azure AD tenant, the user is created in an unmanaged, or viral
27
-
tenant. The user can create an account with an organization's domain,
28
-
not under the lifecycle management of the organization's IT. Access can
29
-
persist after the user leaves the organization.
19
+
Prior to August 2022, Azure AD B2B supported Self-service sign-up for email-verified users which allowed users to create Azure AD accounts if they can verify ownership of the email. These accounts were created in unmanaged (aka “viral”) tenants. This meant that the user created an account with an organization’s domain that is not under the lifecycle management of the organization’s IT and access can persist after the user leaves the organization. To learn more, see, [What is self-service sign-up for Azure Active Directory?](./directory-self-service-signup.md)
30
20
31
-
## Remove unmanaged Azure AD accounts
32
-
33
-
You can remove unmanaged Azure AD accounts from your Azure AD tenants
34
-
and prevent these types of accounts from redeeming future invitations.
21
+
The creation of unmanaged Azure AD accounts via Azure AD B2B is now deprecated and new B2B invitations cannot be redeemed with these accounts as of August 2022. However, invitations sent prior to August 2022 could have been redeemed with unmanaged Azure AD accounts.
PowerShell module to identify viral users in an Azure AD tenant and
44
-
reset user redemption status.
25
+
Admins can use either this sample application in [Azure-samples/Remove-unmanaged-guests](https://github.com/Azure-Samples/Remove-Unmanaged-Guests) or PowerShell cmdlets in [AzureAD/MSIdentityTools](https://github.com/AzureAD/MSIdentityTools/wiki/) to remove existing unmanaged Azure AD accounts from your Azure AD tenants. These tools allow you to identify viral users in your Azure AD tenant and reset the redemption status of these users.
45
26
46
-
Once the above steps are complete, when users with unmanaged Azure AD accounts try to access your tenant, they'll re-redeem their invitations. However, because Email OTP is enabled, Azure AD will prevent users from redeeming with an existing unmanaged Azure AD account and they’ll redeem with another account type. Google Federation and SAML/WS-Fed aren't enabled by default. So by default, these users will redeem with either an MSA or Email OTP, with MSA taking precedence. For a full explanation on the B2B redemption precedence, refer to the [redemption precedence flow chart](../external-identities/redemption-experience.md#invitation-redemption-flow).
27
+
Once you have run one of the available tools, when users with unmanaged Azure AD accounts try to access your tenant, they will re-redeem their invitations. However, Azure AD will prevent users from redeeming with an existing unmanaged Azure AD account and they’ll redeem with another account type. Google Federation and SAML/WS-Fed are not enabled by default. So by default, these users will redeem with either an MSA or Email OTP, with MSA taking precedence. For a full explanation on the B2B redemption precedence, refer to the [redemption precedence flow chart](../external-identities/redemption-experience.md#invitation-redemption-flow).
47
28
48
29
## Overtaken tenants and domains
49
30
@@ -59,11 +40,7 @@ In some cases, overtaken domains might not be updated, for example, missing a DN
59
40
60
41
## Reset redemption using a sample application
61
42
62
-
Before you begin, to identify and reset unmanaged Azure AD account redemption:
0 commit comments