Maptician SCIM User Deactivation Guidance
Contact Us
If you still have questions or prefer to get help directly, please reach out to your technical contact.
Table of Contents
ℹ️ NOTE
This guide applies to organizations that use Microsoft Entra ID (formerly Azure AD) to provision users to Maptician via SCIM. If your organization uses a different identity provider, please contact the Maptician support team for guidance specific to your setup.
Overview
When your organization uses Microsoft Entra ID to manage user accounts, those users are automatically synced to Maptician through SCIM provisioning. Approximately every 40 minutes, Entra compares its user list against Maptician. For each user, it checks whether a matching record already exists in Maptician. If a match is found, Entra updates the existing record. If no match is found, Entra attempts to create a new one.
How you handle user departures and returns in Entra directly impacts whether this sync continues to function correctly. This guide outlines the recommended approach for temporarily deactivating users, such as seasonal employees, summer interns, or employees on extended leave, so that their accounts can be cleanly reactivated when they return.
The Problem: Deleting Users Breaks the Sync
When a user is deleted from Microsoft Entra ID, the account enters a soft delete state for 30 days. After 30 days, Entra permanently removes (hard deletes) the user and severs the connection between Entra and the user's record in Maptician.
If that same person later returns and a new Entra account is created for them (or the original account is restored after the 30-day window), Entra no longer recognizes the existing Maptician record. It treats the user as brand new and attempts to create a duplicate. Maptician correctly rejects this because the email already exists, but Entra keeps retrying on every sync cycle, generating hundreds or thousands of failed provisioning attempts.
⚠️ IMPORTANT
During this failed-retry process, Entra may prepend a long internal identifier to the front of the user's email address. Instead of storing JSmith@company.com, Maptician ends up with something like 195f30d516514ba38b1c0b993fb809d7JSmith@company.com. This corrupted username prevents the systems from matching the user and can also impact other integrations, such as Microsoft IP-Based Presence detection.
Recommended Approach: Disable, Don't Delete
For any user who may return in the future, the recommended approach is to disable their account in Entra rather than deleting it. Disabling the account blocks the user from signing in to all Microsoft services but preserves the SCIM relationship with Maptician. When the user returns, simply re-enable the account and Entra will cleanly reactivate them in Maptician without any data corruption.
How to Disable a User Account in Entra
- Sign in to the Microsoft Entra admin center (entra.microsoft.com) or the Azure portal.
- Navigate to Users > All users and select the user(s) you want to deactivate.
- Click Edit > Edit account status.
- Select Disable account (Block users from signing in).
- Click Save.
What Happens When You Disable a User
Within approximately 40 minutes of disabling the account, Entra's provisioning service automatically sends an update to Maptician setting the user to inactive. The user is deactivated in Maptician and no longer counts as an active user for billing purposes. No manual action is required on the Maptician side.
How to Reactivate a User
When the user returns, follow the same steps above but select Enable account (Allow users to sign in) instead. On the next sync cycle, Entra will send an update to Maptician to reactivate the user. The user's existing data, history, and integrations in Maptician will be preserved.
💡 TIP
Because reactivation happens on Entra's normal 40-minute sync cycle, there may be a short delay between re-enabling the account in Entra and the user appearing as active in Maptician. No action is needed on the Maptician side during this window.
What to Avoid
The following actions will break the SCIM provisioning link and cause sync errors if the user is later reprovisioned:
- Deleting the user from Entra ID. After 30 days, the account is permanently removed and the SCIM relationship is severed.
- Removing the user from the Maptician enterprise application assignment. This takes the user out of provisioning scope and can cause the same linkage issues upon reassignment.
- Manually deleting or deactivating the user in Maptician while they are still assigned in Entra. This can create a mismatch between the two systems.
Common Scenarios
| Scenario | Recommended Action | Result in Maptician |
|---|---|---|
| Summer intern leaving for the season | Disable account in Entra | User deactivated automatically; no active user charge |
| Intern returns next summer | Re-enable account in Entra | User reactivated cleanly with all data intact |
| Employee on extended leave | Disable account in Entra | User deactivated; reactivates cleanly on return |
| Employee permanently departing | Delete from Entra (standard offboarding) | User permanently removed after 30-day retention |
Summary
💡 TIP
If a user may return, disable their account in Entra rather than deleting it. This preserves the provisioning link between Entra and Maptician, prevents data corruption, ensures the user does not count as active during their absence, and allows for a clean reactivation when they return.
If you have questions about this process or need assistance with users who are currently experiencing provisioning errors, please contact the Maptician support team.