The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When a SCIM client deprovisions someone, the SaaS should change only the SCIM resource that client is authorized to manage in its tenant—not automatically erase a shared identity or disrupt the person’s access to other tenants. The right action depends on what the product models as a SCIM User: a tenant membership, a tenant-scoped account, or a global identity. RFC 7644 leaves that tenant mapping to the service provider.
Keep three outcomes separate: revoke access, remove a tenant membership, and erase retained data. SCIM defines how a resource disappears from the protocol’s view; it does not decide which business records to purge or how long logs and backups must be kept.
As an Amazon Associate I earn from qualifying purchases.
What does SCIM deprovisioning mean?
SCIM deprovisioning is not one universal database operation. It is an identity-provider request that the receiving service maps to its own resource and access model. A tenant’s provisioning client might manage a membership belonging only to that tenant, or it might manage a tenant-scoped account. The SaaS must define that relationship and apply the request within the client’s authorized tenant context.
Free tools Windows power users keep installed
One-click scans. No signup required.
In practice, distinguish these actions:
- Revoke access: prevent sign-in or API use, often by setting the SCIM User’s
activeattribute tofalse. - Remove tenant membership: end the person’s association with the tenant whose identity provider sent the event.
- Delete a global identity: remove the shared person or login record, if the product’s identity model and remaining memberships permit it.
- Erase retained data: purge application records, audit history, exports, or backups under the product’s retention policy, contract, and applicable legal obligations.
These actions can coincide, but a tenant offboarding event should not silently turn into a global identity deletion or a data-erasure decision.
What does SCIM DELETE require?
RFC 7644 §3.6 defines HTTP DELETE as the client’s request to remove a SCIM resource. The service provider may retain the resource internally rather than permanently erasing it. However, after treating the resource as deleted, the provider must return HTTP 404 for operations associated with it and omit it from later query results. In other words, the protocol specifies what clients can observe, not whether every underlying record has been physically purged. Read RFC 7644.
The standard does not set a universal retention schedule for related business data, audit records, or backups. Define those separately from the SCIM resource’s protocol status.
How should a SaaS scope the request to a tenant?
RFC 7644 §6 does not prescribe a universal multi-tenancy scheme. It leaves the service provider to associate provisioning clients and requests with tenants, and to secure any cross-tenant access. A safe implementation authorizes the client first, then resolves and mutates resources only inside that authorized tenant context.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallKeep identifiers tenant-scoped
RFC 7644 does not require provider-assigned SCIM id values to be globally unique across tenants. A client-supplied externalId needs to be unique only among resources associated with that tenant. Do not use externalId as an assumed global person key or look it up globally before deleting. Resolve identifiers against the tenant associated with the authenticated provisioning client.
Rank #3
Separate the person from each membership
For a product where one person can belong to multiple customers, model the shared identity independently from each tenant membership. Keep tenant-specific roles, group assignments, provisioning identifiers, and access state with the appropriate membership where the product supports that design. When one tenant sends a deprovisioning event, check the membership it controls; do not remove another tenant’s access as a side effect.
How should active:false and DELETE be mapped?
The SCIM protocol does not make active:false and DELETE interchangeable product actions. Document the exact state transition each request triggers, including whether it affects a membership or a shared account, and whether it can be reversed.
| Request or behavior | What it means at the protocol or vendor level | What the SaaS must define |
|---|---|---|
Set active to false |
Microsoft Entra describes disable for SCIM applications as a request to set active to false. Microsoft Entra provisioning behavior. |
Whether this disables the tenant membership, suspends an account, or triggers another documented transition. |
| Soft deprovisioning | GitHub Enterprise Cloud documents setting active to false, suspending the user, and obfuscating login and email fields. This is GitHub’s product-specific behavior, not a general SCIM definition. GitHub Enterprise Cloud SCIM API. |
Which information or access changes, whether the transition is reversible, and whether it is scoped to one tenant. |
SCIM DELETE |
Microsoft’s SCIM API reference documents DELETE /users/{id} returning HTTP 204 on success. That is a vendor API response contract, not a requirement to erase every connected application record. Microsoft Entra SCIM API reference. |
Which SCIM resource is removed, whether it is retained internally, and how related records are handled under the product’s retention policy. |
Vendor labels such as “soft” or “hard” deprovisioning describe that vendor’s implementation. They do not establish a universal meaning for SCIM DELETE.
What should the SaaS delete when a tenant offboards someone?
- Authenticate and authorize the provisioning client. Establish the tenant or tenants it is permitted to manage before looking up the resource.
- Resolve the SCIM resource within that tenant. Apply the client’s identifier in the authorized tenant context rather than performing an unscoped global lookup.
- Apply the documented operation mapping. For
active:false, change the defined access or membership state. ForDELETE, remove the SCIM resource from subsequent API operations in accordance with RFC 7644. - Preserve unrelated memberships. Before removing a shared global identity, check whether the person still has memberships or ownership in other tenants.
- Handle retained data under a separate policy. Decide what happens to business data, audit history, exports, and backups under the product’s contractual, legal, and retention requirements.
What should teams test?
Test in a sandbox with separate tenants and provisioning clients. Confirm that each client can manage only its authorized tenant’s resources, including when identifiers overlap. Verify that a request cannot mutate another tenant’s resource, that repeated deprovisioning has a documented result, and that ending one membership leaves unrelated tenant access intact.
Best Value
Also verify the protocol-visible behavior after DELETE: the deleted resource should return 404 for associated operations and be absent from later query results. Separately confirm that the product’s stated retention and purge behavior matches what actually happens to related data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
