Convert Proofpoint Users to Functional Accounts

Learn how to convert terminated users to Functional Accounts in Proofpoint Essentials to reclaim licenses after converting them to M365 shared mailboxes.

May 22, 2026 By Chris

This guide explains how to convert a standard Proofpoint user into a Functional Account. This is necessary to prevent unnecessary billing and to reclaim user licenses when an employee is terminated and their Microsoft 365 account is converted into a shared mailbox.

This process applies to the IT Support team handling offboarding requests. It should be performed immediately after the Microsoft 365 shared mailbox conversion is complete so that inbound mail routing continues uninterrupted.

Log In to Proofpoint Essentials

Step #1: Navigate to the Proofpoint Essentials login page. — Navigate to the Proofpoint Essentials login page.

Step #2: In IT Glue, go to the Passwords list under your organization and search for proofpoint to locate the Master Admin account credentials. — In **IT Glue**, go to the **Passwords** list under your organization and search for `proofpoint` to locate the Master Admin account credentials.

Step #3: Enter the credentials into Proofpoint. Retrieve the 6-digit verification code from the Google Voice SMS Slack channel, paste it into the prompt, and click Confirm to log in. — Enter the credentials into Proofpoint. Retrieve the 6-digit verification code from the **Google Voice SMS** Slack channel, paste it into the prompt, and click **Confirm** to log in.

Navigate to the Customer Organization

Step #4: Click the Customers drop-down in the top navigation menu. — Click the **Customers** drop-down in the top navigation menu.

Step #5: Search for and select the specific customer organization you need to manage. — Search for and select the specific customer organization you need to manage.

Convert Users to Functional Accounts

Do not delete the user account. Deleting the user will remove their routing configuration entirely. You must update their role to a Functional Account instead.

Step #6: Click on Users under the User Management section in the left sidebar. — Click on **Users** under the **User Management** section in the left sidebar.

Step #7: Check the boxes next to the terminated users whose accounts have been converted to shared mailboxes. — Check the boxes next to the terminated users whose accounts have been converted to shared mailboxes.

Step #8: Click the Mass Update Users button located above the user list. — Click the **Mass Update Users** button located above the user list.

Step #9: In the Mass Update modal, open the Role drop-down menu and select Functional Account. — In the Mass Update modal, open the **Role** drop-down menu and select **Functional Account**.

Step #10: Click Update Users to apply the configuration. — Click **Update Users** to apply the configuration.

The role change can take up to 20 minutes to fully propagate across the Proofpoint system. You may close the portal once the update is submitted.

FAQ

Q: How long does it take for the role change to apply?

A: It can take up to 20 minutes for the Functional Account conversion to fully process and update the system's routing and billing records.

Q: Where do I find the MFA code to log in to the Proofpoint Master Admin account?

A: The 6-digit verification code is automatically routed to the Google Voice SMS channel in Slack.

Q: Should I delete the user if they were terminated?

A: No. If their Microsoft 365 account was converted to a shared mailbox and still needs to receive email, deleting the Proofpoint user will break mail delivery. Always convert them to a Functional Account to retain routing while freeing up the license.

Glossary

Term	Definition
Functional Account	A mailbox type in Proofpoint used for shared or utility accounts that do not consume a billable active user license.
Master Admin Account	The top-level administrative account used to manage all downstream customer organizations within Proofpoint Essentials.
Shared Mailbox	A Microsoft 365 mailbox that multiple users can access, which does not require an individual paid user license.