Unable to Remove User

[Reggie Taylor]

is synced from an identity provider.

Remove this user in your identity provider instead.

Account was disabled in IDP but continue to get the error posted above.

[Maya Lindholm]

Hi Reggie,

Disabling the account in the IdP may not be enough if the Atlassian user is still linked to a SCIM/provisioning record or still included in a pushed group/app assignment.

I would check it in this order:

1. In the IdP, confirm the user is not only disabled, but also removed from the Atlassian app assignment and any groups that are pushed to Atlassian.

2. Trigger or wait for the next provisioning sync.

3. In Atlassian Administration, check the identity provider / user provisioning area for sync errors or a still-linked user record.

4. After the provisioning link is gone, try removing product/site access again from Atlassian Administration.

The key clue is the wording "synced from an identity provider." If Atlassian still sees the account as IdP-managed, it will keep telling you to make the change at the source.

If the user still appears after that, I would check the provisioning logs for a failed deprovision/delete action rather than only checking whether the user looks disabled in the IdP UI.

[Reggie Taylor]

Hi Maya,

Yes the users are deactivated and removed from the push groups. Even after a few syncs we were still unable to remove them

And yes, that was the confusing part on my end. I'll try 3 and 4 and will give you an update.

[Dave LIAO]

@Reggie Taylor - what IdP are you using?

If you're on Okta, try ensuring that user's SCIM user record is no longer being synced to Atlassian?

https://support.atlassian.com/atlassian-cloud/kb/how-to-manage-account-sync-actions-in-atlassian-admin-hub/

If you break the SCIM link between the Atlassian account and the IdP record, you then should be able to proceed.

[Reggie Taylor]

We are using OKTA. 

I was thinking about doing this since once of the users I'm trying to remove made the SCIM integration and wanted to reconnect using a service account.