Accounts appearing active in IDE Services after SCIM provisioning adjustments

Problem

After removing users from a designated Microsoft Entra ID security group intended for SCIM provisioning, they can no longer sign in. However, these users still appear as active in the JetBrains IDE Services dashboard under the Users tab.

Cause

The SCIM provisioning configuration was dependent on group assignments in Entra ID. Initially, the same group was not consistently assigned for both the SSO and SCIM provisioning enterprise applications. This caused a disconnect, where changes in group membership were not properly reflected in the IDE Services dashboard.

Resolution

1. Assign the same security group to both the SSO and SCIM provisioning enterprise applications in Microsoft Entra ID as the SCIM provisioning heavily relies on the assignment concept. Besides, please ensure to assign a specific group of users or individual users to the SCIM app for them to be provisioned correctly.

2. Next, double-check if Provisioning works properly on the group level. Expand 'Mapping' and select 'Provision Microsoft Entra ID Groups'. You need to make sure it's enabled and all three possible actions are listed for it: Create, Update & Delete. After that, please make sure the corresponding group is assigned to the app and the affected users are removed from the group and are not assigned to the app individually.

3. Pause and restart SCIM provisioning in Entra ID to ensure synchronization, ban inactive users, and update their status in JetBrains IDE Services.

4. Monitor the SCIM provisioning logs available in the Entra SCIM enterprise app to verify the status updates of users (e.g., disabled or removed) and confirm changes are syncing properly to IDE Services.

5. Cross-check the updated user status in both the IDE Services dashboard and the provisioning logs to confirm consistency. The account statuses should be synchronized properly and reflect the intended changes, as observed in the IDE Services dashboard.

This sequence of checks ensures that user lifecycle management through SCIM provisioning works as expected, avoiding manual interventions.