View All Resources

PennO365: Account Provisioning and Deprovisioning

PennO365 accounts are automatically provisioned for people in PennCommunity who are sponsored by participating organizations and have an active eligible affiliation in PennCommunity.  IT organizations then determine which of these automatically provisioned PennO365 accounts need to have mailboxes enabled.  In our process design, PennO365 will deactivate any automatically provisioned account if the account no longer has an active eligible PennCommunity affiliation. Once automatic deprovisioning is enabled, accounts belonging to users that do not have an active eligible affiliation will be automatically deleted sixty (days) after their affiliation became inactive.  The mailbox will not receive mail while deprovisioned.


The following criteria have to be met:

ISC recommends the following steps:

  1. Log into Cloud Control.
  2. Select the "Reports" tab at the top of the page.
  3. Choose "Advanced Reports" from the left-hand menu. It is easier to have the output produce a .csv file than to output to the browser and you can only choose the output format with Advanced Reports.
  4. Choose to run the "Exchange Users - On-premises" report. You don't need to change any of the form values except for the last value.  Make sure to select "CSV file" and "Generate Report".
  5. Open your .csv output file in Excel.
  6. Log into O365 Tools (
  7. Choose "O365 enrollment" from the left-hand menu.
  8. Choose to filter by "People" and make sure that "Expiring" is checked.
  9. Copy the last column of logon names from the Cloud Control .csv output.  Paste these names in the "People" block and submit.  The list of those users from your submitted list of logon names that are expiring will display in your browser.

This is an example of one of the reports that ISC produces.  It is a report of O365 users who have a mailbox but have been flagged for deprovisioning. 

Column M lists the active affiliations for the user.

Column N shows why the person has been flagged for deprovisioning. Column O shows in days when the account will be deprovisioned.

Column W shows the scheduled deletion date for the user.

This report also includes information about the user like Job_org, department and full display name (which has been blanked out here) so that the LSP can make a decision about whether to keep the account alive or not.

  • You must give the person an active affiliation from the list of eligible affiliations.  CTSY (Courtesy) is an affiliation that would keep the user active in PennO365 but limit access to other University systems.
  • If you are not the PennKey administrator for your group, please contact the PennKey administrator to create an active affiliation.
  • Timing is critical.  ISC disables accounts that are scheduled to be deprovisioned one day before the scheduled deprovisioning date to avoid sync problems with Cloud Control.
  1. Give the person an appropriate affiliation in PennCommunity.
  2. Override the person the PennCommunity/O365 app so that your center now sponsors the person.
  3. Wait for 15-20 minutes for the PennCommunity information to sync with PennO365 and for autoprovisioning to complete.
  4. Use Cloud Control to mailbox enable the person as usual.
  5. Wait for up to an hour for all stages of mailbox enablement and licensing to complete.

If you want the contents of the old mailbox to be attached to the newly reinstated account, you must reinstate the account within 30 days of deprovisioning.