Azure Provisioning on demand doesn't work when removing user

Question

Removing a user from the application was not support by Azure provisioning on demand?

Here is my set up, active is the expression as shown in https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/how-provisioning-works

However, when I remove the user from the application, I only receive the warning, and Azure send a partial update instead

How can I update with on demand provisioning when I try to remove a user from an application?

Answer 1

Hi @Anh Hoang ,

Thanks for reaching out.

This is a known issue with the current version of our SCIM client. We offer a feature flag to fix this as well as some other issues. Please see https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/application-provisioning-config-problem-scim-compatibility#flags-to-alter-the-scim-behavior for information on the flag and the changes it introduces, as well as how to use the flag.

Unfortunately, this flag will not work with Provision on Demand.

You need to use either a switch statement based on [isSoftDeleted] - or the simpler Not([isSoftDeleted]) expression. You shouldn't use accountEnabled as the source attribute as that only covers the user account being enabled/disabled in Azure AD/Entra ID, and doesn't account for unassignment from the app, scoping filters, or being soft deleted in Azure AD/Entra ID.

Hope this will help.

Thanks,

Shweta

---

Please remember to "Accept Answer" if answer helped you.