Auto-Deprovisioning Leavers via Entra ID

Overview

Auto-deprovisioning runs a nightly sync that checks the Entra ID account status of every Microsoft-linked user in your UniAsset organization. If a user's Entra account has been disabled — because they left the company or were suspended — UniAsset deactivates their account automatically.

Without this feature, a user whose Entra account is disabled could still hold an active UniAsset account until an administrator removes them manually.

Plan required: Enterprise

Prerequisite: Microsoft Entra ID must be connected first. See Connecting Microsoft Entra ID.

Who Can Access This

Required role: Owner or Admin

Enabling Auto-Deprovisioning

1. Log in to UniAsset as an Owner or Admin
2. Click Settings in the left sidebar
3. Select the Integrations tab
4. Click Microsoft Entra ID
5. Toggle Auto-deprovision sync to on
6. Click Save

The sync will run for the first time at the next scheduled window.

How the Sync Works

When auto-deprovisioning is enabled, UniAsset runs a nightly check at 3am UTC:

1. UniAsset queries the Microsoft Graph API for the account status of each Microsoft-linked user in your organization
2. Any user whose Entra account is found to be disabled is deactivated in UniAsset
3. Deactivated users cannot log in; their assets and history are preserved

Users who are not linked to a Microsoft account (e.g., they signed up with email and password or Google SSO) are not affected by the sync.

💡 TIP: The sync only acts on users whose Entra accounts are disabled. Deleting a user from Entra without first disabling them may delay deprovisioning until the next sync after deletion is reflected in the Graph API.

What "Deactivated" Means

A deactivated user:

• Cannot log in to UniAsset
• Retains all assigned assets — asset records are preserved and remain visible to active users
• Retains full history — audit trail entries, maintenance logs, and document uploads remain attributed to them
• Can be reactivated manually if needed (see Reactivating Users)

Deactivation is not deletion. No data is lost.

Running a Manual Sync

If you need to act immediately — for example, when an employee leaves and their Entra account has just been disabled — you can trigger the sync on demand:

1. Go to Settings → Integrations → Microsoft Entra ID
2. Click Sync Now
3. UniAsset queries Entra and deactivates any users whose accounts are now disabled

The manual sync runs the same check as the nightly sync.

Reactivating a Deactivated User

If a user was deactivated by the sync but should still have access — for example, if their Entra account was re-enabled — you can reactivate them manually:

1. Go to Settings → Users
2. Find the deactivated user (filter by Deactivated status if needed)
3. Click ⋮ (three-dot menu) next to the user
4. Select Reactivate

See Reactivating Users for the full guide.

⚠️ WARNING: If auto-deprovisioning is still enabled and the user's Entra account remains disabled, the next nightly sync will deactivate them again. Re-enable their Entra account first before reactivating in UniAsset.

Disabling Auto-Deprovisioning

1. Go to Settings → Integrations → Microsoft Entra ID
2. Toggle Auto-deprovision sync to off
3. Click Save

Existing deactivated users are not reactivated when you disable the sync. It only stops future automatic deactivations.

Related Articles

• Connecting Microsoft Entra ID
• Auto-Provisioning Users from Entra ID
• Group to Role Mapping
• Reactivating Users
• Deactivating Users

Need Help?

Contact support at support@uniasset.app with questions about auto-deprovisioning. Include the affected user's email address and the date the Entra account was disabled.