Is is possible avoid deleting a user via SCIM provisioning when AccountEnabled=false in an Azure AD Enterprise Application?

0
votes

My Azure AD admin have created an Enterprise App for me and I'm Configuration Owner for it.

The app Provisioning is setup to:

  • Provision Azure Active Directory Groups
  • Provision Azure Active Directory Users

to my SCIM server.

The setup is working fine, users are created via and groups are updated also.

My problem is that in my company workflow when a consultant contract is renewed the user's AccountEnabled property is set to false and then later re-enabled with AccountEnabled=true, this is translating right now into a Delete / Create via SCIM in my app.

My impression was that AccountEnabled=false would translate to a isSoftDeleted=true (as mentioned in Customizing user provisioning attribute-mappings for SaaS application in Azure Active Directory) and that in turn will translate to a SCIM Disable User request because of the attribute mapping settings of the app is to map the Azure Active Directory Attribute Not([IsSoftDeleted]) to active attribute in the app.

But it's not disabling the user it's deleting it.

The user resides in a on-premises Active Directory then synced to Azure AD.

All the information that I could find (like this) suggest that a SCIM Delete should only happened after 30 days when a user is hard deleted and not when AccountEnabled=false so I guess it may be another factor at play.

So, how do I stop Azure AD from issuing Delete user for disabled users in my app?.

EDIT: I tested with a local user in Azure AD (not synced from the on-premises AD) and with that user when the user is disabled it triggers an update user not a delete. So it must be related with synced users only (I'm still troubleshooting)

2
azure-active-directoryscim

2 Answers

0
votes
  1. Certain applications don't support soft deletes so the Azure AD provisioning service sends a delete in place of an update. What app are you using?
  2. The attribute mapping blade allows you to de-select delete as an option, do the deletes stop when you do that?
  3. I recommend keeping the attribute mappings as close to the default as possible.
0
votes

Try removing the "not" function and using the default attribute mappings. The default mapping uses a switch statement to map false to true and true to false. It sends the request as a string rather than a boolean.