Skip to content

Commit 50066af

Browse files
authored
Update clean-up-unmanaged-azure-ad-accounts.md
Viral accounts are now deprecated and Email OTP is no longer a pre-req for running these tools. Updating doc to reflect these changes.
1 parent 3704d8a commit 50066af

File tree

1 file changed

+7
-30
lines changed

1 file changed

+7
-30
lines changed

articles/active-directory/enterprise-users/clean-up-unmanaged-azure-ad-accounts.md

Lines changed: 7 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -16,34 +16,15 @@ ms.collection: M365-identity-device-management
1616

1717
# Clean up unmanaged Azure Active Directory accounts
1818

19-
Azure Active Directory (Azure AD) supports self-service sign-up for
20-
email-verified users. Users can create Azure AD accounts if they can
21-
verify email ownership. To learn more, see, [What is self-service
22-
sign-up for Azure Active
23-
Directory?](./directory-self-service-signup.md)
24-
25-
However, if a user creates an account, and the domain isn't verified in
26-
an Azure AD tenant, the user is created in an unmanaged, or viral
27-
tenant. The user can create an account with an organization's domain,
28-
not under the lifecycle management of the organization's IT. Access can
29-
persist after the user leaves the organization.
19+
Prior to August 2022, Azure AD B2B supported Self-service sign-up for email-verified users which allowed users to create Azure AD accounts if they can verify ownership of the email. These accounts were created in unmanaged (aka “viral”) tenants. This meant that the user created an account with an organization’s domain that is not under the lifecycle management of the organization’s IT and access can persist after the user leaves the organization. To learn more, see, [What is self-service sign-up for Azure Active Directory?](./directory-self-service-signup.md)
3020

31-
## Remove unmanaged Azure AD accounts
32-
33-
You can remove unmanaged Azure AD accounts from your Azure AD tenants
34-
and prevent these types of accounts from redeeming future invitations.
21+
The creation of unmanaged Azure AD accounts via Azure AD B2B is now deprecated and new B2B invitations cannot be redeemed with these accounts as of August 2022. However, invitations sent prior to August 2022 could have been redeemed with unmanaged Azure AD accounts.
3522

36-
1. Enable [email one-time
37-
passcode](../external-identities/one-time-passcode.md#enable-email-one-time-passcode)
38-
(OTP).
23+
## Remove unmanaged Azure AD accounts
3924

40-
2. Use the sample application in [Azure-samples/Remove-unmanaged-guests](https://github.com/Azure-Samples/Remove-Unmanaged-Guests) or
41-
go to
42-
[AzureAD/MSIdentityTools](https://github.com/AzureAD/MSIdentityTools/wiki/)
43-
PowerShell module to identify viral users in an Azure AD tenant and
44-
reset user redemption status.
25+
Admins can use either this sample application in [Azure-samples/Remove-unmanaged-guests](https://github.com/Azure-Samples/Remove-Unmanaged-Guests) or PowerShell cmdlets in [AzureAD/MSIdentityTools](https://github.com/AzureAD/MSIdentityTools/wiki/) to remove existing unmanaged Azure AD accounts from your Azure AD tenants. These tools allow you to identify viral users in your Azure AD tenant and reset the redemption status of these users.
4526

46-
Once the above steps are complete, when users with unmanaged Azure AD accounts try to access your tenant, they'll re-redeem their invitations. However, because Email OTP is enabled, Azure AD will prevent users from redeeming with an existing unmanaged Azure AD account and they’ll redeem with another account type. Google Federation and SAML/WS-Fed aren't enabled by default. So by default, these users will redeem with either an MSA or Email OTP, with MSA taking precedence. For a full explanation on the B2B redemption precedence, refer to the [redemption precedence flow chart](../external-identities/redemption-experience.md#invitation-redemption-flow).
27+
Once you have run one of the available tools, when users with unmanaged Azure AD accounts try to access your tenant, they will re-redeem their invitations. However, Azure AD will prevent users from redeeming with an existing unmanaged Azure AD account and they’ll redeem with another account type. Google Federation and SAML/WS-Fed are not enabled by default. So by default, these users will redeem with either an MSA or Email OTP, with MSA taking precedence. For a full explanation on the B2B redemption precedence, refer to the [redemption precedence flow chart](../external-identities/redemption-experience.md#invitation-redemption-flow).
4728

4829
## Overtaken tenants and domains
4930

@@ -59,11 +40,7 @@ In some cases, overtaken domains might not be updated, for example, missing a DN
5940

6041
## Reset redemption using a sample application
6142

62-
Before you begin, to identify and reset unmanaged Azure AD account redemption:
63-
64-
1. Ensure email OTP is enabled.
65-
66-
2. Use the sample application on
43+
Use the sample application on
6744
[Azure-Samples/Remove-Unmanaged-Guests](https://github.com/Azure-Samples/Remove-Unmanaged-Guests).
6845

6946
## Reset redemption using MSIdentityTools PowerShell Module
@@ -103,4 +80,4 @@ To delete unmanaged Azure AD accounts, run:
10380
## Next steps
10481

10582
Examples of using
106-
[Get-MSIdUnmanagedExternalUser](https://github.com/AzureAD/MSIdentityTools/wiki/Get-MsIdUnmanagedExternalUser)
83+
[Get-MSIdUnmanagedExternalUser](https://github.com/AzureAD/MSIdentityTools/wiki/Get-MsIdUnmanagedExternalUser)

0 commit comments

Comments
 (0)