User Provisioning Skipped When User Unassigned from Enterprise App in Azure AD

Question

Using Azure AD (Entra ID) for connecting to an external app and supporting SSO, the intention is to control user management entirely from Azure.

User provisioning works when users are assigned to the app, resulting in user creation in the external app. However, synchronization is skipped when attempting to unassign a user from the app. It seems that a patch request should be sent with the active status set to false, as a delete request is only sent if the user is actually deleted. I can work with any request being sent (be it a delete or patch request).

Is there a way to resolve this issue?

(Edit: Removed the solution needing free EntraID tier requirement)

Answer 1

Hello @Pankaj Patil

Thank you for reaching out to Microsoft Q&A.

We understand that you are facing an issue with user provisioning when users are being unassigned from the app, else it is working as expected. Typically, the NotEffectivelyEntitled skip reason is noticed when there is a problem with the user assignment record stored in Microsoft Entra ID. To fix this issue, try stopping the provisioning service from the Azure portal, adding the user and removing it again. Also, if a required attribute is missing the provisioning process might skip that user. Ensure all necessary attributes are correctly configured.

Kindly refer the document for more information: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-config-problem-no-users-provisioned

Hope this helps. Do let us know if you any further queries.

Thanks & Regards

Janaki Kota

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful.