Entra ID Won't Send Delete Requests

Luke Schwemler 0 Reputation points
2025-07-10T17:07:15.59+00:00

I'm working on Entra ID provisioning support for an app. I've set it up as an enterprise application, and I'm receiving (and responding to) provisioning requests. When I add accounts to my app on Entra ID, it successfully provisions them on my app and Entra displays that it is synchronized. However, for both hard deletes and soft deletes, I am not receiving any PATCH, PUT, or DELETE requests for the deleted users. This occurs (or rather, fails to occur) for both deleting the entire user, and for just deleting the connection between the Entra ID user and my app. I've investigated a few potential causes without any results;

  • My accidental delete threshold is set to 500. I am deleting only single users at a time. I've had nowhere even close to 500 users total.
  • I am monitoring all requests my app is receiving, I am 100% confident that there is simply not any requests coming in to disable or delete provisioned users
  • In Attribute Mapping -> Target Object Actions, I have the Create, Update, and Delete options all enabled. Attribute mapping is also enabled.
  • The user 'active' attribute is set to Switch([IsSoftDeleted], , "False", "True", "True", "False") (the default value)
  • The provisioning scope is set to "All users and groups"
  • "Skip Out Of Scope Deletions" is set to false

I've checked the provisioning logs - when a user is soft-deleted, after next sync there is a skipped update for that user with the following info:

Result: Skipped

Description: The User '<redacted>' will be skipped due to the following reasons: 1) This object is not active in the source system.

SkipReason: NotEffectivelyEntitled

IsActive: False

Assigned to the application: True

IsInProvisioningScope: True

ScopeEvaluationResult: {}

ReportableIdentifier: <redacted>

Note that the <redacted>s are mine, Entra is showing the user email address here. It makes sense that soft-deleting a user marks their account as inactive, but I can't fathom why this wouldn't update the provisioned account to also disable it. Nothing shows up in the logs for hard deleted users.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
{count} votes

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.