Unverified50% confidenceFactExact time
Not all identity directories proactively send deprovisioning events; some IdPs do not send a separate user-level deprovisioning request when a user is removed from a group or has their application assignment revoked.
1
Sources
50%
Confidence
Long-term
Relevance
9/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedWhen a user loses membership in their sole authorizing group, the deprovisioning process should be triggered even if no user-level active=false event has been received.73% similarUnverifiedIf an application only listens for DELETE requests while the IdP actually sends a PATCH with active=false, deactivated users may still retain system access, posing a security risk.70% similarUnverifiedAzure AD triggers a DELETE request in some configurations when an administrator directly removes a user from an application assignment, but if a user gained access through a group assignment and is then removed from the group, Azure AD may only send a group membership change event without sending a user-level deprovisioning request.68% similarUnverifiedIdentity propagation must occur on the trusted server side, and frontend or user-controllable parameters must never be allowed to determine the scope of data access.67% similarUnverifiedDuring reconciliation, the unique user identifier should use the IdP-side id as the primary key rather than userName or email, because the latter may change due to rename operations.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/910720API
curl https://kongchang.com/api/v1/knowledge/claims/910720MCP
get_claim(id=910720)