Microsoft Licensing Automation Project

The first phase of Microsoft license automation was implemented on May 14, 2025.

That phase focused on building the necessary Grouper logic to reliably identify a user's affiliation based on their job code (HCM) or academic program status (Campus Solutions), send automated notifications, and automatically adjust users' licenses according to a clearly defined schedule.

Due to the limited scope of Phase 1, the automation was designed to ensure only eligible users were assigned employee licenses, while avoiding changes that would result in a user losing access to their CU Boulder-provided Microsoft OneDrive or email account before adequate communication could be provided.

New Licenses & License Upgrades

When the automation identified a newly eligible user or a user who was entitled to additional Microsoft services, it:

1. Added them to the corresponding system-of-record group in Grouper.
2. Automatically assigned the correct Microsoft license to their primary account.

These users did not receive any automated communications during Phase 1.

License Downgrades

When the automation determined that a user was no longer entitled to their student license, it moved them to a Grouper hold group to be addressed in Phase 2. These users' licenses were not adjusted, and they did not receive any automated communications.

When the automation determined that a user was no longer entitled to their employee license, it:

1. Moved them to a Grouper hold group.
2. Sent an automated email informing the user that their Microsoft license would be adjusted in 30 days.
3. Completed the appropriate action on day 30:
   • If the user had regained eligibility for an employee license, the process was terminated. No license changes were made, and no automated emails were sent.
   • If the user was eligible for a student or affiliate license, their employee license was replaced with the correct license.
   • If the user wasn't eligible for any Microsoft license or was eligible for an email-only license (i.e., retiree or alumni), their employee license was replaced with a temporary affiliate license until their use case could be addressed in Phase 2.

The second phase of Microsoft license automation will be implemented on June 16, 2026.

In this phase, OIT is fully automating the Microsoft licensing process for CU Boulder users' primary accounts, as well as the data deletion process for users who are no longer eligible for Microsoft OneDrive and/or CU Boulder email.

Note: Secondary accounts, including EXC accounts for student employees, will be addressed in a future phase.

With this new automation:

• new and upgraded Microsoft licenses will be assigned immediately; users will receive one email notification
• license downgrades to a student or affiliate license will occur after 30 days; users will receive two email notifications
• license downgrades to a retiree license will occur after 90 days; users will receive four email notifications
• license removals for ineligible users will occur after 90 days; users will receive four email notifications
• recent graduates will experience two license changes:
  • their existing license will be replaced with an alumni license after 90 days; users will receive four email notifications
  • their alumni license will be removed after 365 days; users will receive five email notifications
• after the mandatory data retention period, ineligible users' Microsoft OneDrive and email account will be permanently deleted

If a user regains eligibility for their existing license during the 30- or 90-day grace period, the current process will be terminated, and the user will receive an automated email about their new entitlements.

For email notification and license adjustment timelines, see "When the automation identifies that a user is entitled to a new or different Microsoft license (or no license at all), how far in advance are they notified about the license change?"

In future phases, the project team intends to:

• automate license adjustments for secondary accounts
• review the existing process for requesting license changes and add-ons
• explore methods of copying supervisors on automated communications sent to current and former faculty, staff and affiliates
• evaluate opportunities to expand automation to other services

Absolutely. To describe the official Microsoft 365 license plans, OIT uses role-based language in our user communications to reinforce the relationship between a specific Microsoft license and the users to whom it's assigned.

In the table below, you'll find OIT's user-facing license name, followed by the internal shorthand campus IT professionals often use to refer to that license, then Microsoft's official license name.

*This license may also be referred to as "email only," "Exchange only" or "Plan 1."

The chart below provides general information about which users are entitled to each license type and when they can expect to have their license assigned.

Individuals who are currently ineligible for a campus-provided Microsoft license include applicants for admission, trainees, POI types other than C and D, former employees (excluding retirees and emeritus faculty members) and former students

Users with existing access to CU Boulder-provided Microsoft services will only be affected by this phase of the project if their role changed in the last year and they haven't yet been assigned the correct license for their new role.

This would include students who became alumni, employees who retired, and users who resigned from their position or withdrew from their academic program in the last year.

In the future, this automation will apply to anyone whose role changes in a way that affects their eligibility for a campus-provided Microsoft license, whether because they become eligible for more Microsoft services, fewer services or none at all.

Starting June 16, 2026, any user who is assigned a new license or has their existing license replaced or removed will receive one or more communications informing them of these changes and the timeline upon which they can expect the changes to happen.

These communications will link to resources to help impacted users prepare for the change in licensing and to prevent inadvertent data loss, including:

• A Microsoft license comparison tool (coming soon) that lists all services and applications that will become available, be adjusted or be removed when their license changes.
• A digital offboarding guide that recommends tasks for users to complete if they're going to lose access to Microsoft OneDrive and/or CU Boulder email.

The table below summarizes the email notification schedule for affected users and the date on which the license will change based on the type of adjustment.

Note: Day 0 represents the date on which OIT identifies a mismatch between a user's eligibility and their assigned Microsoft license.

The primary consideration a departing user needs to think about is preventing unintended data loss that could interfere with academic, research or business continuity or personal needs.

Departing users should review OIT's digital offboarding guide for users who are going to lose access to Microsoft OneDrive and/or CU Boulder email and take the recommended steps to prevent unintended data loss.

In addition, because Google Drive will soon require multi-factor authentication (MFA) through Microsoft, departing users who will no longer be entitled to any Microsoft license should also take steps to preserve important files stored in their Google Drive. These users will be unable to access Google Drive once their Microsoft license is removed.

Temporary faculty are eligible for an employee Microsoft license.

In recognition that temporary faculty often have semester or longer gaps between appointments and there is a desire for these faculty to retain their Microsoft access during these gaps, the automation will ensure that temporary faculty:

• Are assigned their employee Microsoft license as early as 90 days before their appointment begins (provided their appointment has been entered and approved in HCM), and
• Retain their employee Microsoft license for 180 days after their appointment ends.

As a result, most temporary faculty will not lose access to their email, OneDrive cloud storage and Microsoft tools and features between appointments.

Temporary faculty members who anticipate having more than a 180-day gap between appointments should work with their department if continuous access is desired and supported by the department. A person of interest (POI) appointment may be appropriate in these cases.

Retired faculty are eligible for one of two Microsoft license types:

• A retiree license will be assigned to most retired faculty. This is an email-only license that does not include desktop apps or OneDrive cloud storage.
• An employee license (the same license they were entitled to before they retired) will be assigned to retired faculty who have emeritus status in HCM or who are hired back as working faculty retirees.

Whether a retired faculty member experiences an automated license change and deletion of data upon retirement depends on whether they have been appointed to emeritus status or hired back as a working faculty retiree and when that appointment begins.

• Once the automation launches on June 16, 2026, retired faculty who haven't been appointed to emeritus status or hired as working faculty retirees will retain their employee license for 90 days, after which they will be transitioned to an email-only retiree license and will lose access to their OneDrive. Thirty days after this license change, their OneDrive data will be deleted.
• If the retiring faculty member is appointed to emeritus status or hired into a working faculty retiree appointment within 120 days of their retirement date (or of June 16, 2026, whichever is later), they will receive an employee license and regain access to their OneDrive cloud storage before it is deleted.
• If the retiring faculty member is appointed to emeritus status or hired into a working faculty retiree appointment more than 120 days after their retirement date (or of June 16, 2026, whichever is later), they will still be returned to an employee license and will regain access to their OneDrive, but all of their OneDrive data will have already been deleted.

Retiring faculty who anticipate being appointed to emeritus status and/or a working faculty retiree appointment should work with their departments to understand the expected timeline for these appointments.

If this timeline is likely to extend beyond 120 days, they should work with their department if continuous access is desired and supported by the department. A person of interest (POI) appointment may be appropriate in these cases to ensure OneDrive data is not prematurely deleted. Alternately, retiring faculty should take steps to save important data to an alternate storage location before it is deleted.

Retired staff are eligible for one of two Microsoft license types:

• A retiree license will be assigned to most retired staff. This is a more limited, email-only license that does not include desktop apps or OneDrive cloud storage.
• An employee license (the same license they were entitled to before they retired) will be assigned to retired staff who are hired back as working retirees.

Whether a retired staff member experiences an automated license change and deletion of data upon retirement depends on whether they have been hired back as a working retiree and when that appointment begins.

• Once the automation launches on June 16, 2026, retired staff who haven't been appointed as a working retiree will retain their employee license for 90 days, after which they will be transitioned to a retiree email-only license and will lose access to their OneDrive. Thirty days after this license change, their OneDrive data will be deleted.
• If the retiring staff member is hired into a working retiree appointment within 120 days of their retirement date (or of June 16, 2026, whichever is later), they will receive an employee license and regain access to their OneDrive cloud storage before it is deleted.
• If the retiring staff member is hired into a working retiree appointment more than 120 days after their retirement date (or of June 16, 2026, whichever is later), they will still be returned to an employee license and will regain access to their OneDrive, but all of their OneDrive data will have already been deleted.

Retiring staff members who anticipate being hired into a working retiree appointment should work with their department(s) to understand the expected hiring timeline.

If this timeline is likely to extend beyond 120 days, they should work with their department to be entered as a qualifying person of interest (POI) type to ensure their OneDrive data is not prematurely deleted and/or they should take steps to save important data to an alternate storage location before it is deleted.

Employees and affiliates who separate from CU Boulder and do not become retirees are not eligible for a campus-provided Microsoft license.

Once the automation launches on June 16, 2026:

1. Former employees will retain their employee license and former affiliates will retain their affiliate license for 90 days.
2. On day 90, they will lose access to all Microsoft applications and services provided by CU Boulder, including their campus email account. They will also lose the ability to authenticate into campus services that require Microsoft MFA, including Google Drive.
3. On day 120, their Microsoft OneDrive and email account will be deleted.

Once a student stops taking classes at CU Boulder, their student record will be flagged as inactive (a.k.a., discontinued) after a set period of time. For details, see the Office of the Registrar's Withdraw from the Semester information.

Once the automation launches on June 16, 2026:

1. Discontinued students will retain their student Microsoft license for 90 days.
2. On day 90, their Microsoft license will be removed. At that time, they will lose access to all Microsoft applications and services provided by CU Boulder, including their campus email account.
3. On day 120, their Microsoft OneDrive and email account will be deleted.

Students who graduated before Jan. 14, 2026, will lose access to their CU Boulder email account on Aug. 31, 2026, as described on the alumni email service change project webpage.

Students who earn a degree or certificate from CU Boulder after Jan. 14, 2026, are eligible for an alumni Microsoft license for one year following graduation.

Once the automation launches on June 16:

1. New graduates will retain their student Microsoft license for 90 days after their degree or certificate is posted to their transcript.
2. On day 90, they will be assigned an alumni email-only Microsoft license. At that time, they will lose access to all Microsoft applications and services provided by CU Boulder, other than their email.
3. On day 120, their Microsoft OneDrive will be deleted.
4. On day 365, their Microsoft license will be removed, and their CU Boulder email account will be deleted.

Departmental IT professionals can help support their departments by:

• Reviewing the information OIT posted about this project in the IT Community of Practice's Microsoft Teams channel on April 29, 2026.
• Referencing OIT's digital offboarding guidance.
• Amplifying the guidance OIT is providing to IT users and supervisors about how to prevent unintended data loss.
• Working with departmental leadership to ensure there are appropriate shared and continuously accessible locations for departing departmental users to preserve individual OneDrive files that are critical to academic, research and/or business continuity (e.g., Teams shared file locations and/or SharePoint sites).
• Encouraging employees to contact the IT Service Center (oithelp@colorado.edu or 303-735-4357) immediately if they believe a license change they've been notified about is incorrect.

In an upcoming phase of this project, OIT intends to explore potential methods of copying supervisors on the email notifications sent to their employees.

Until that functionality is in place, department supervisors can help support their employees by:

• Reviewing the email OIT will send to all supervisors about this project on June 8, 2026.
• Referencing OIT's digital offboarding guidance.
• Working with departing employees prior to their departure date (when possible) to preserve individual OneDrive files that are critical to academic, research and business continuity in a shared and continuously accessible locations (e.g., Teams shared file locations and/or SharePoint sites).
• Taking steps to preserve departing employees' data if they didn't do so themselves before departing.
• Encouraging employees to contact the IT Service Center (oithelp@colorado.edu or 303-735-4357) immediately if they believe a license change they've been notified about is incorrect.

HR liaisons can help support their departments by:

• Reviewing the presentation OIT gave about this project at the full HR meeting on May 8, 2026.
• Ensuring that departmental employee appointments are entered in a timely and accurate manner to ensure employees have access to the appropriate Microsoft tools and features for their roles.
• Referencing OIT's digital offboarding guidance and incorporating it into your department's checkout procedures for departing employees.
• Amplifying the guidance OIT is providing to IT users and supervisors about how to prevent unintended data loss.
• Encouraging employees to contact the IT Service Center (oithelp@colorado.edu or 303-735-4357) immediately if they believe a license change they've been notified about is incorrect.

Academic advisors can help support their students by:

• Referencing OIT's digital offboarding guidance.
• Ensuring that your students are aware of what will happen to their email and OneDrive data upon graduating or withdrawing.
• Amplifying the guidance OIT is providing to IT users about how to prevent unintended data loss.
• Encouraging students to contact the IT Service Center (oithelp@colorado.edu or 303-735-4357) immediately if they believe a license change they've been notified about is incorrect.