When you remove a user from your PowerDMARC application in Microsoft Entra ID, SCIM provisioning should deactivate that user in PowerDMARC too. This article shows how to set up the active attribute mapping so that users who are unassigned from the application, or deleted in Entra ID, are deactivated (soft deleted) in PowerDMARC.
Why this matters: Without this mapping, users you offboard in Entra ID can stay active in PowerDMARC and keep access to your account.
Before You Begin
- SCIM provisioning must already be set up between Microsoft Entra ID and PowerDMARC. If it isn’t, follow the SCIM Configuration Guide for Microsoft Entra ID first.
- You need a role in Entra ID that can edit provisioning settings for enterprise applications, such as Application Administrator or Cloud Application Administrator.
How Deprovisioning Works
| Action in Microsoft Entra ID | Result in PowerDMARC |
|---|---|
| User is unassigned from the PowerDMARC application | User is deactivated (soft deleted) |
| User is deleted in Entra ID | User is deactivated (soft deleted) |
| User is reassigned to the application | User is reactivated |
Changes are applied in the next provisioning cycle, which usually runs every 40 minutes. To apply a change right away, use Provision on demand (see Verify the Configuration).
Configure the Active Mapping
- Open the application
In the Microsoft Entra admin center, go to Applications > Enterprise applications > All applications, and select your PowerDMARC application. - Open the user attribute mappings
Go to Provisioning > Attribute mapping, then select Provision Microsoft Entra ID Users. - Edit or add the active mapping
- If active is already listed under customappsso Attribute, click Edit next to it.
- If not, click Add New Mapping.
- Enter the following settings
Field Value Mapping type Expression Expression Not([IsSoftDeleted]) Default value if null Leave empty Target attribute active Match objects using this attribute No Apply this mapping Always - Save your changes
Click OK, then click Save at the top of the Attribute Mapping page.
| WARNING | Each target attribute can have only one mapping. If active is currently mapped to accountEnabled, edit that mapping and replace it. Don’t add a second one. |
|---|
Your final user attribute mappings should look like this:
| customappsso Attribute | Microsoft Entra ID Attribute | Matching precedence |
|---|---|---|
| userName | 1 | |
| active | Not([IsSoftDeleted]) | |
| displayName | displayName | |
| userType | SingleAppRoleAssignment([appRoleAssignments]) |
Verify the Configuration
Test with one user before you rely on the mapping for your whole organization.
- Assign a test user to the PowerDMARC application in Entra ID.
- Go to Provisioning > Provision on demand, search for the test user, and click Provision.
- Confirm the user appears as active in PowerDMARC under Settings > Users.
- In Entra ID, remove the test user from the application under Users and groups.
- Run Provision on demand for the test user again.
- Confirm the user is now deactivated in PowerDMARC.
Things to Keep in Mind
| NOTE | Disabling a user’s sign-in in Entra ID while they stay assigned to the application doesn’t deactivate them in PowerDMARC. To deactivate a user, unassign them from the application or delete them in Entra ID. |
|---|
| NOTE | Deactivated users are soft deleted, not permanently removed. If you reassign the user to the application, they’re reactivated in the next provisioning cycle. |
|---|
Related Articles
For further assistance, visit support.powerdmarc.com or contact your PowerDMARC account manager.
The article’s two NOTE statements still need checking before you publish:
- Disabling a user’s sign-in doesn’t deactivate them. I believe that’s how Not([IsSoftDeleted]) behaves, but nobody has tested it. If a quick test shows that disabling does deactivate the user, delete that note.
- Reassigning a user reactivates them. That’s standard SCIM behaviour, but Jeremy only tested the deactivation. Run a quick reassign test on our side to be sure.
Deactivating Users Removed from Entra ID
The active mapping in this guide (accountEnabled) deactivates users in PowerDMARC when their account is disabled in Microsoft Entra ID. It doesn’t deactivate users who are unassigned from the application or deleted in Entra ID.
If you offboard users by removing them from the application or deleting them, see SCIM Deprovisioning with Microsoft Entra ID: Deactivate Removed Users Automatically.
| NOTE | Each target attribute can have only one mapping. Choose the active mapping that matches how your organization offboards users. |
|---|
Changes to the new article so the two read as a pair
- Opening paragraph. Add this as the second sentence: “This replaces the accountEnabled mapping described in the SCIM Configuration Guide for Microsoft Entra ID, which only deactivates users whose account is disabled.”
- Keep the WARNING about replacing the accountEnabled mapping. It’s now the key point, since anyone arriving from the original guide will already have that mapping.
- Change the first NOTE to: “With this mapping, disabling a user’s sign-in in Entra ID while they stay assigned to the application doesn’t deactivate them in PowerDMARC. If you need that behavior, use the accountEnabled mapping from the SCIM Configuration Guide instead.”
Publish the new article first so you have its link, then add the block to the original. The original guide’s typo fixes and the userType “Only during object creation” change from the earlier Google Doc still apply. Only the active mapping section stays as it is.