When an employee resigns, one of the common Microsoft 365 administration tasks is removing their account from the company address book.

Simply deleting the user's Microsoft 365 account is often not the right approach, because the organization may still need access to the employee's mailbox, OneDrive files, emails, or other business data.

A better approach is to hide the former employee from the Microsoft 365 Global Address List (GAL) while keeping the account and mailbox available for administrative or business purposes.

This article explains how to configure Microsoft 365 so that resigned staff can be automatically hidden from the company address book.

1. What Happens When an Employee Resigns?

A typical offboarding process may include:

• Blocking the user's sign-in
• Removing Microsoft 365 licenses
• Converting the mailbox to a shared mailbox, if required
• Removing the user from security and distribution groups
• Transferring OneDrive ownership or business data
• Removing access to company applications
• Hiding the user from the Global Address List

The last step is important because simply blocking sign-in does not automatically remove the user from the Microsoft 365 address book.

The former employee may continue to appear when users search for their name in Outlook.

2. The Microsoft 365 Setting You Need

Exchange Online has a property called:

Hide from address lists

When this property is enabled, the mailbox is hidden from address lists such as the Global Address List.

For example:

Before:

John Smith – john.smith@company.com

appears in Outlook's address book.

After:

John Smith

is hidden from the address book, while the mailbox can still exist in Microsoft 365.

This is useful when the organization needs to retain the mailbox but does not want employees to continue seeing the resigned user's account.

3. Manual Method

For a small number of users, an administrator can manually hide the user.

Using Exchange Online PowerShell:

Connect-ExchangeOnline

Then run:

Set-Mailbox -Identity "john.smith@company.com" -HiddenFromAddressListsEnabled $true

To verify:

Get-Mailbox -Identity "john.smith@company.com" |
Select-Object DisplayName,HiddenFromAddressListsEnabled

The result should show:

DisplayName                  HiddenFromAddressListsEnabled
-----------                  -----------------------------
John Smith                   True

The user will then be hidden from Exchange address lists.

4. Why Automate This?

Manually hiding every resigned employee can become difficult for an IT team, especially when there are many employee departures.

For example:

HR → Employee Resigns → IT Offboarding → Hide from GAL

Instead of relying on an administrator to remember the final step, the process can be automated using an attribute or group that identifies employees who have left the company.

A common approach is to create an Offboarded/Resigned Users group and use automation to process its members.

5. Recommended Offboarding Workflow

A simple automated workflow can look like this:

Employee Resigns
       ↓
HR updates employee status
       ↓
User added to "Resigned Staff" group
       ↓
Automation detects the user
       ↓
Exchange Online mailbox is hidden
       ↓
User disappears from the GAL
       ↓
Other offboarding actions continue

This approach provides a clear separation between the HR decision and the IT technical action.

6. Using Microsoft Entra ID

If the organization uses Microsoft Entra ID, another option is to use an employee attribute to identify former employees.

For example:

employeeType = FormerEmployee

or an appropriate organizational attribute used by the company.

The automation can periodically identify users matching the criteria and hide their Exchange mailbox from address lists.

However, the exact attribute should be chosen carefully because it must be consistently maintained by HR or the identity-management process.

7. PowerShell Automation Example

For organizations using Exchange Online PowerShell, a scheduled script can identify users according to an agreed condition and hide their mailboxes.

For example:

Connect-ExchangeOnline

$Users = Get-Mailbox -ResultSize Unlimited |
    Where-Object {$_.CustomAttribute1 -eq "Resigned"}

foreach ($User in $Users) {

    if ($User.HiddenFromAddressListsEnabled -ne $true) {

        Set-Mailbox `
            -Identity $User.Identity `
            -HiddenFromAddressListsEnabled $true

        Write-Host "Hidden from GAL: $($User.DisplayName)"
    }
}

Disconnect-ExchangeOnline -Confirm:$false

In this example, the organization uses:

CustomAttribute1 = Resigned

as the trigger.

Do not use this exact attribute without first confirming that it is not already being used for another purpose in your tenant.

8. An Even Better Approach: Combine Offboarding Actions

Instead of creating a script that only hides the user from the address book, IT can incorporate the action into the organization's complete offboarding process.

For example:

                    Employee Resigns
                           │
                           ▼
                    HR Notification
                           │
                           ▼
                  Disable Sign-In
                           │
                           ▼
                Remove User Access
                           │
              ┌────────────┴────────────┐
              ▼                         ▼
        Mailbox Actions            OneDrive
              │                         │
              ▼                         ▼
       Hide from GAL              Transfer Data
              │
              ▼
       Remove Groups
              │
              ▼
        Complete Audit

This reduces the possibility of an employee being disabled but still appearing in the company's address book.

9. Important: Hiding Is Not the Same as Deleting

One of the most important points for Microsoft 365 administrators is that:

Hiding a mailbox does not delete the mailbox.

The following are separate actions:

Therefore, hiding the account from the GAL can be useful when the organization needs to retain the mailbox or account for a period of time.

10. Don't Forget Mobile and Outlook Address Book Caching

After hiding a user, the change may not appear immediately everywhere.

Microsoft 365 services and Outlook clients can cache address-book information.

Users may therefore temporarily see the former employee in Outlook search or cached results.

This does not necessarily mean that the configuration has failed.

Administrators should verify the change using Exchange Online and, where necessary, allow time for address-list changes to propagate.

11. Testing the Configuration

Before implementing automation for all employees, test with a single test account.

Step 1 – Check the current status

Get-Mailbox "test.user@company.com" |
Select DisplayName,HiddenFromAddressListsEnabled

Step 2 – Hide the mailbox

Set-Mailbox "test.user@company.com" `
-HiddenFromAddressListsEnabled $true

Step 3 – Verify

Get-Mailbox "test.user@company.com" |
Select DisplayName,HiddenFromAddressListsEnabled

The expected result is:

HiddenFromAddressListsEnabled : True

Step 4 – Test Outlook

Search for the user from another employee's Outlook address book and verify that the account is no longer displayed.

12. Recommended Design for an IT Department

For a larger organization, I recommend making HR's employee status the trigger, rather than asking IT administrators to manually remember to hide each employee.

A good design would be:

HR identifies resignation → HR/identity process marks the user → automated offboarding process runs → mailbox is hidden from GAL → IT receives an audit result.

This provides:

• Consistent offboarding
• Less manual work
• Reduced risk of missed accounts
• Better security
• Easier auditing
• Clear responsibility between HR and IT

Conclusion

Automatically removing resigned employees from the Microsoft 365 address book does not necessarily require deleting their Microsoft 365 account or mailbox.

The key Exchange Online setting is:

-HiddenFromAddressListsEnabled $true

By incorporating this setting into an automated offboarding workflow, organizations can ensure that former employees are removed from the Global Address List while their mailbox and business data can be retained according to the organization's retention and offboarding requirements.

For organizations already using Microsoft Entra ID and Microsoft 365, this can be integrated into a broader automated employee lifecycle process rather than being treated as a separate manual task.