Share via

Azure AD User provisioning not sending update with active:False when user assignment is removed from my custom non-gallery application

Ram 6 Reputation points
2020-12-04T11:29:18.55+00:00

The User 'xxx' will be skipped due to the following reasons: 1) This object is not assigned to the application. If you did not expect the object to be skipped, assign the object to the application or change your scoping filter to allow all users and groups to be in scope for provisioning. 2) This object does not have required entitlement for provisioning. If you did not expect the object to be skipped, update provisioning scope to 'Sync all users and groups' or assign the object to the application with entitlement of provisioning category

I have updated the below settings as well.

https://learn.microsoft.com/en-us/answers/questions/15611/azure-ad-user-provisioning-not-sending-patch-activ.html

Microsoft Security Microsoft Entra Microsoft Entra ID

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator
    2020-12-04T19:00:50.807+00:00

    Hello @Ram , try stopping the provisioning service from the Azure portal, adding the user and removing it again. Alternatively take a look to the troublehoosting documentation.

    Please let me know if you need more help. If the answer was helpful to you, please accept it and, optionally, provide feedback so that other members in the community can benefit from it.

  2. Danny Zollner 10,801 Reputation points Microsoft Employee Moderator
    2020-12-10T21:29:30.27+00:00

    You'll need to open a support case to investigate this. The expectation is that a user that is unassigned from the application will be disabled(PATCH for Active = False). If you aren't seeing that happen, it's indicative of a problem either with our service, the provisioning configuration of your application, or of the SCIM implementation on the application you have connected Azure AD to. For the second issue with not receiving a value for the manager attribute - same thing, one of our support engineers will need to help you determine what is happening here.

  3. Matthias Fleschütz 26 Reputation points
    2022-07-22T05:59:55.297+00:00

    Hi @Natan Zeferino ,

    yes and no: one workaround that seems to do the trick is using groups: we use a custom-made script solution that is de-nesting our nested on-premise group into flat member clones of these groups. These groups are then synchronized from on-prem (hybrid environment) to AAD and assigned to Apps. By doing it this way users dropping out of the scope seem to be recognized.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.