Update-MgUser -AccountEnabled:$false: block sign-in for a Microsoft Entra ID user

To block sign-in for a user in Microsoft Entra ID with PowerShell, connect to Microsoft Graph with a scope that can change the property and run Update-MgUser -UserId UPN -AccountEnabled:$false. The colon matters: -AccountEnabled is a switch parameter, so -AccountEnabled $false with a space does not do what it looks like.

Connect-MgGraph -Scopes 'User.EnableDisableAccount.All', 'User.Read.All'
Update-MgUser -UserId adele@contoso.com -AccountEnabled:$false
Get-MgUser -UserId adele@contoso.com -Property UserPrincipalName, AccountEnabled |
  Select-Object UserPrincipalName, AccountEnabled

Replace the UPN with yours. The last command should print AccountEnabled as False. To unblock the user, run the same command with -AccountEnabled (or -AccountEnabled:$true).

Why the colon is required

The block reads the parameter type from Microsoft.Graph.Users 2.41.2 and shows both spellings. Neither contacts Microsoft Graph, so no tenant is needed:

Import-Module Microsoft.Graph.Users
'-AccountEnabled type: ' + (Get-Command Update-MgUser).Parameters['AccountEnabled'].ParameterType.Name
try { Update-MgUser -UserId adele@contoso.com -AccountEnabled $false -ErrorAction Stop } catch { $_.Exception.Message }
try { Update-MgUser -UserId adele@contoso.com -AccountEnabled:$false -ErrorAction Stop } catch { $_.Exception.Message }

-AccountEnabled type: SwitchParameter
A positional parameter cannot be found that accepts argument 'False'.
Authentication needed. Please call Connect-MgGraph.

With the space, PowerShell binds -AccountEnabled as present (true) and has no parameter left for False, so the call fails during binding; see A positional parameter cannot be found. With the colon it binds correctly and only stops because there is no Graph session yet; see Authentication needed. Please call Connect-MgGraph.

Permissions and roles

Without enough rights the call fails with Insufficient privileges to complete the operation; see that error page.

Offboarding sequence

Blocking sign-in stops new sign-ins; it does not end sessions that already have tokens. A usual order is:

Update-MgUser -UserId adele@contoso.com -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId adele@contoso.com     # Microsoft.Graph.Users.Actions

The revoke call invalidates the user's refresh tokens and browser session cookies, so apps must sign in again, which now fails. It needs User.RevokeSessions.All, and Microsoft notes a delay of a few minutes before the tokens are revoked. It does not revoke sessions of external (guest) users, who sign in through their home tenant.

Block many users from a CSV

Import-Csv .\leavers.csv | ForEach-Object {
  Update-MgUser -UserId $_.UserPrincipalName -AccountEnabled:$false
}

The CSV needs a UserPrincipalName column. Check the result with Get-MgUser -Filter 'accountEnabled eq false' -All.

PowerShell versions

Microsoft.Graph runs in Windows PowerShell 5.1 and PowerShell 7. The older Set-MsolUser -BlockCredential $true and Set-AzureADUser -AccountEnabled $false commands belonged to the retired MSOnline and AzureAD modules; in AzureAD the parameter was a Boolean, which is why scripts migrated from it often keep the space and break.

FAQ