Issue Removing ExternalAzureAD Identity for Previously External User

Question

I have a user in my AD that was previously external, then it became part of the organization, but I cannot delete the ExternalAzureAD identity.

Where the issuerAssignedId was deleted but I cannot delete this identity

Is there a way to remove it?

and be able to leave it as is all the users with a single identity

Answer 1

Hi @Marcelo Ulloa Fernández .

If you have an internal user showing as ExternalAzureAD (or federated), you likely need to reset the redemption status with the correct user email added to the internal user object.

To resolve this you can use the Graph Invitation API, add the external address to the user's account, and then reset the invite status following this guide:
https://learn.microsoft.com/en-us/azure/active-directory/external-identities/reset-redemption-status

Note that in order to delete an external user you need to have a role assigned that has permission to delete users, and some user types can only be deleted by Global Admins or Privileged Auth Admins. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/privileged-roles-permissions?tabs=admin-center#who-can-perform-sensitive-actions

Let me know if this helps address your question and if I understood your concern correctly.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching the same question. Otherwise please let me know if you have further questions.