Cannot delete or modify IDE Services users via API when Identity Provider sync is enabled

Problem

Attempting to create, edit, or delete a user through the JetBrains IDE Services REST API (for example, DELETE /api/v1/users/{id}) returns the following error while synchronization with an Identity Provider is enabled:

User modification is not permitted when synchronisation with an Identity Provider is enabled. Please manage users in the Identity Provider and synchronise them with IDE Services.

The same restriction applies to user management in the IDE Services web UI. Adding scopes or permissions to the automation token does not remove the error.

Cause

When synchronization with an Identity Provider (for example, Okta or Microsoft Entra ID) is enabled, IDE Services treats the Identity Provider as the single source of truth for user accounts. To keep both systems consistent, IDE Services blocks user creation, editing, and deletion through the REST API and the web UI. The restriction is enforced on the server and is independent of the token's permissions. Assigning existing users to profiles remains available.

Resolution

Manage the user lifecycle in the Identity Provider and let synchronization propagate the change to IDE Services:

1. Remove or deprovision the user in the Identity Provider, or remove them from the group or scope that is synchronized with IDE Services.
2. Wait for the next scheduled synchronization, or trigger it manually with the Synchronize users action on the Users page.
3. Confirm the account status has updated in the IDE Services Users list.

On IDE Services Cloud, removing an Identity-Provider-managed user deactivates the account rather than deleting it. The account stays visible in the Users list as deactivated. A hard-delete of Identity-Provider-managed users is not available in IDE Services Cloud at this time.

On self-hosted (on-premises) IDE Services, the DELETE /api/v1/users/{id} endpoint can be used to remove a user that is not managed by synchronization.

If a removed user still appears active after synchronization, verify that the same security group is assigned to both the SSO and provisioning applications in the Identity Provider, and that the provisioning mapping includes create, update, and delete actions, then restart provisioning to force a sync. See Accounts appearing active in IDE Services after SCIM provisioning adjustments.