You have federated Microsoft® 365™ to RM Unify. Your RM Unify users are put into Microsoft 365 security groups based on their RM Unify role, e.g. Students, Teaching Staff etc.

When an RM Unify account is first deleted, we first remove the Microsoft 365 licence assigned to that user. The user's Microsoft 365 account remains and therefore the account also remains as a member of the relevant Microsoft 365 security group.

If an RM Unify account remains deleted for nine months or longer, we send a housekeeping task to Microsoft 365 to delete the user account. At this point, the account will be removed from all Microsoft 365 security groups it was a member of. Further details of our data retention policy can be found here.

Deleting an unlicensed Microsoft 365 account will remove it from any Microsoft 365 groups it is a member of. RM Unify-federated Microsoft 365 accounts are automatically deleted if the RM Unify account remains deleted for nine months or longer. The deletion of unlicensed RM Unify-federated Microsoft 365 accounts prior to this nine months period is the responsibility of the Microsoft 365 administrator.

If you intend to use the Windows® PowerShell® commands in this article, here are the requirements:

• Connect to Microsoft 365 PowerShell on a computer* with an Internet connection: https://docs.microsoft.com/en-us/microsoft-365/enterprise/connect-to-microsoft-365-powershell?view=o365-worldwide
• Microsoft 365 global administrator credentials.
• Your tenancy domain name (which usually ends in .onmicrosoft.com). This is the site you originally created in Microsoft 365, before adding your school domain and can be found under the Domains section in your 'Microsoft 365 admin center'.

* You can use the following versions of Windows:

• Windows 10
• Windows Server® 2016, 2019

1. Log on to https://portal.office.com/AdminPortal/Home#/users as a Microsoft 365 global administrator.
2. From the Users menu (left-hand side), select 'Active users'.
3. From the Views drop-down menu, select 'Unlicensed users'.
4. Tick the boxes of all the users you wish to delete and from the 'Bulk actions' menu (right-hand side), select 'Delete users'.
5. Read the information and warning that is displayed and click 'Delete to continue'.

1. Log on to https://portal.office.com/AdminPortal/Home#/users as a Microsoft 365 global administrator.
2. From the Groups menu (left-hand side), select Groups.
3. From the View drop-down menu, select 'Security group'.
4. In the Members section of the next window, click Edit and click the X icon for each user you wish to remove from the group.
5. When you have finished, click Save and then Close.

When RM Unify provisions users into Microsoft 365, it will populate the 'Job title' field with the RM Unify role appropriate to that user. RM Unify also provisions security groups for each RM Unify role, populating the Description field of that group.
Note: The following example PowerShell script will remove all unlicensed users from the specified group. The script uses the user's 'Job title' field and the group's Description field in Microsoft 365. If these have been altered from the RM Unify supported defaults, then you will need to adjust the script accordingly.

1. Open PowerShell, type Connect-MsolService and connect to your tenancy using your Microsoft 365 global administrator account.
2. Find the Microsoft 365 security group that you wish to clear of unlicensed users. Make a note of its Description. In the following example, we will remove unlicensed Student users from the Students (1234567) security group in the SchoolA.com domain.
3. Run the following commands, one at a time:
   
   $domain=<SchoolA.com>
   $securityGroup = Get-MsolGroup -GroupType "Security" | Where-Object {$_.DisplayName -eq "<Students (1234567)>"}
   
   $members = Get-MsolUser -domainname $domain -All -UnlicensedUsersOnly | Where {$_.title -eq "Student"}
   
   foreach($member in $members){
     Remove-MsolGroupMember -GroupObjectId $securityGroup.ObjectId -GroupMemberType User -Groupmemberobjectid $member.ObjectId
   }
   
4. Repeat steps 2 and 3 for any additional users and groups.
5. The script will display errors for any users that were not members of the chosen security group. This is expected:
   "Remove-MsolGroupMember : The member you are trying to delete is not in this group".